NWPentestUtils

KO | EN

gitlite — search

#javascript #hacktoberfest #typescript #golang #go #rust #deep-learning #linux #macos #nodejs #java #cli #mcp #ios

(★ 13)

Scripts for Network Pentesting

NWPentestUtils 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# NWPentestUtils
This is a set of scripts for network pentesting. This repository also contains scripts that can be used for attacks, but should only be used for ethical hacking.

## Motivation
Network scanners such as Nessus and GVM (OpenVAS) are very useful for pentests, but they are very time consuming. 
If you want to scan an entire huge company network, it will take several days. That's why these scripts were developed to make pentesting more efficient.

## Requirements
- [Nmap](https://nmap.org/)
- [Nikto](https://cirt.net/Nikto2)

## How to specify the target
There are many scripts that specify the target in a txt file.
The txt file specifying the target will be in the following format:

```
192.168.100.0/24
172.16.0.0/12
```

The txt file specifying the exclude ip will be in the following format:

```
192.168.100.8 192.168.100.15
```

## Port scan
These scripts will do a port scan using nmap and save the results as xml.
The results are saved in XML format in the file `./results/yyyymmdd/127.0.0.1_syn_ping_yyyymmdd_hhmmss.xml`.
`./results/` is listed in gitginore.

### portscan-tcp-all.sh
This script requires administrative privileges to use SYN scan.
It scan all TCP ports without checking whether the host exists by pinging.

```
$ sudo ./portscan-tcp-all.sh -T<1-5> <target-hosts-list.txt> <exclude-hosts-list.txt>
```

Log format: `./results/<today>/<ip_range>_<now>.xml`

### portscan-tcp-rapid.sh
This script requires administrative privileges to use SYN scan.
It scan nmap top 1000 ports with checking whether the host exists by pinging.

```
$ sudo ./portscan-tcp-rapid.sh -T<1-5> <target-hosts-list.txt> <exclude-hosts-list.txt>
```

Log format: `./results/<today>/<ip_range>_<now>.xml`

### portscan-udp.sh
This script requires administrative privileges to use UDP scan.

```
$ sudo ./portscan-udp.sh <target-hosts-list.txt> <exclude-hosts-list.txt>
```

Log format: `./results/<today>/<ip_range>_udp_<now>.xml`

## Find specific middleware
These scripts find a server that can be used as a starting point for an attack.
It save the result in the xml format output by nmap.

### find-db.sh

```
$ ./find-db.sh <target-hosts-list.txt>
```

- Log format:
  - `./results/<today>/<ip_range>_postgres_<now>.xml`
  - `./results/<today>/<ip_range>_redis_<now>.xml`
  - `./results/<today>/<ip_range>_mysql_<now>.xml`

### find-smb.sh

```
$ ./find-smb.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/<ip_range>_smb_<now>.xml`

### find-web.sh

```
$ ./find-web.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/<ip_range>_web_<now>.xml`

### find-snmp.sh
Because SNMP is UDP, it requires administrative privileges.

```
$ sudo ./find-snmp.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/<ip_range>_snmp_<now>.xml`

## Bruteforce
These scripts use nmap to perform brute-force attacks against DB, SMB, and SSH servers and attempt to log in.
It save the result in the xml format output by nmap.
The results are saved in XML format in the file `./results/yyyymmdd/127.0.0.1_noping_yyyymmdd_hhmmss.xml`.
`./results/` is listed in gitginore.

Just being able to break through the authentication and steal the data is a problem, but if you can log into the DB server, there are cases where you can bring it up to RCE.

### bruteforce-mysql.sh

```
$ ./bruteforce-mysql.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/<ip_addr>_mysql_attack_<now>.xml`

### bruteforce-postgres.sh

```
$ ./bruteforce-postgres.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/<ip_addr>_postgres_attack_<now>.xml`

### bruteforce-redis.sh

```
$ ./bruteforce-redis.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/<ip_addr>_redis_attack_<now>.xml`

### bruteforce-smb.sh

```
$ ./bruteforce-smb.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/<ip_addr>_smb_attack_<now>.xml`

### bruteforce-ssh.sh

```
$ ./bruteforce-ssh.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/<ip_addr>_ssh_attack_<now>.xml`

### bruteforce-snmp.sh
Because SNMP is UDP, it requires administrative privileges.

```
$ sudo ./bruteforce-snmp.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/<ip_addr>_snmp_attack_<now>.xml`

## Misc
### check-nmap-ports.sh
You can check the ports that nmap scans, which is useful for specifying the ports to be scanned in the nessus configuration.

#### Usage

```
$ sudo ./check-nmap-ports.sh -sT 1000
```

#### Example

```
$ sudo ./check-nmap-ports.sh -sU 100
# Ports scanned: TCP(0;) UDP(100;7,9,17,19,49,53,67-69,80,88,111,120,123,135-139,158,161-162,177,427,443,445,497,500,514-515,518,520,593,623,626,631,996-999,1022-1023,1025-1030,1433-1434,1645-1646,1701,1718-1719,1812-1813,1900,2000,2048-2049,2222-2223,3283,3456,3703,4444,4500,5000,5060,5353,5632,9200,10000,17185,20031,30718,31337,32768-32769,32771,32815,33281,49152-49154,49156,49181-49182,49185-49186,49188,49190-49194,49200-49201,65024) SCTP(0;) PROTOCOLS(0;)
WARNING: No targets were specified, so 0 hosts scanned.
```

### get-alive-ip.sh

```
$ ./get-alive-ip.sh <target-ip-range>
```

### get-snmp-info.sh
This script return basic information about the SNMP server.
Because SNMP is UDP, it requires administrative privileges.

```
$ sudo ./get-snmp-info.sh <target-ip>
```

### nikto-multi.sh

```
$ ./nikto-multi.sh <target-hosts-list.txt>
```

Log format: `./results/<today>/nikto/<ip_addr>_nikto_<now>.xml`

### nmap-xml2csv.rb
This script converts the xml output of nmap to csv so that it can be copied to Google spreadsheet.
Even if you do not specify the name of the output file, it will be output to `portscan-result.csv` by default.

`./results/` and `portscan-result.csv` are listed in gitginore.

#### Usage

```
$ gem install ruby-nmap
$ ruby nmap-xml2csv.rb <nmap-output>.xml -o <output-file-name>.csv
```

#### Example

```
$ ruby nmap-xml2csv.rb ./results/20201204/192.168.1.0_24_20201204_072122.xml
[+] parse these xml files:
./results/20201204/192.168.1.0_24_20201204_072122.xml
-----------------------------------------------------
192.168.1.1	53(domain), 80(http)
192.168.1.17	22(ssh)
-----------------------------------------------------
[+] Output: portscan-result.csv
```

## License
MIT License

NWPentestUtils

NWPentestUtils 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

NWPentestUtils

NWPentestUtils 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README