dreizehnutters

Automating the First Hours of My Internal Vulnerability Assessments

In this post, I'll share how I automated the first hour of my internal vulnerability assessment using several handy scripts which i crafted over the years and try to demonstrate the power of automation in streamlining the initial phase of the assessment process.

The Need for Automation

Internal vulnerability assessments are crucial for identifying weaknesses within network infrastructure before they can be exploited by malicious actors. However, the manual effort required to initiate scans, gather results, and perform preliminary analysis can be time-consuming, resource-intensive and are mostly repetitive. Automation offers a solution to this challenge, allowing me to kickstart the assessment process and focus my attention on critical analysis and remediation tasks.

Automating offers several benefits:

dreizehnutters

#!/usr/bin/env python3

__version__ = "1.0"
__about__ = "nessus report exporter"

from time import sleep
from os import environ
import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

dreizehnutters

#!/usr/bin/python3

from os import listdir, path
from argparse import ArgumentParser
import xml.etree.ElementTree as ET

__version__ = 1.0

def scan(in_file, search_pattern):
    systems = {}

dreizehnutters

#!/bin/bash

NET=$1
bold=$(tput bold)
normal=$(tput sgr0)
error="${bold}[!]${normal}"
if [ -z "${1}" ]; then
    echo "${0} <NET_IN_CIDR>|<FILE> [--check]"
    exit 1
fi

dreizehnutters

#!/bin/bash

if [ -z "$1" ]; then
   echo "$0 <PATH TO NMAP SCAN RESULTS>"
   exit 1
fi

AUDIT_RESULTS=$1
PREFIX=$2
DB_HOST="127.0.0.1"

dreizehnutters

import json
import csv
from sys import argv

def flatten_dict(dictionary, parent_key='', sep='.'):
    items = []
    for key, value in dictionary.items():
        new_key = f"{parent_key}{sep}{key}" if parent_key else key
        if isinstance(value, dict):
            if "Permissions" in key:

dreizehnutters

#!/bin/bash
# ./prepX.sh <IP> <BOX_PATH> <INTERFACE>

bold=$(tput bold);
normal=$(tput sgr0);
NMAP_MIN_RATE=500;

convert_xml_to_csv() {
    XMLS=/usr/bin/xmlstarlet
    NMAP_PATH="$1/nmap"

dreizehnutters

#!/bin/bash

# This script generates nuclei templates for out-of-band
# testing using a local server in the same network as the target.
# (no Interactsh needed)

template_dir="$1"
oob_server="$2"

if [ -z "$template_dir" ] || [ -z "$oob_server" ]; then

dreizehnutters

"""
what:
    download all sketches (as .zip) from a given user on p5.js
how:
    python <TARGET> [<OUT_DIR>]
who:
    @13utters
"""
from sys import argv, exit
from pathlib import Path

dreizehnutters

//template by @beesandbombs edited by @13utters

int[][] result;
float t, c;
float ease(float p) {
  return 3*p*p - 2*p*p*p;
}

float ease(float p, float g) {
  if (p < 0.5)