Master Script to automate all the recon

master_script.sh

#!/bin/bash

if [ -z "$2" ]
  then
    echo "2nd Argument not supplied"
    echo "2nd argument can be basic or advanced,it used for nmap"
    echo "Usage : ./master_script.sh domain basic|advanced"
    exit 1
fi

#### COLORS #### ( Taken from : https://misc.flogisoft.com/bash/tip_colors_and_formatting )
NORMAL='\e[0m'
RED='\e[31m'
LIGHT_GREEN='\e[92m'
LIGHT_YELLOW='\e[93m'
BLINK='\e[5m'
BOLD='\e[1m'
UNDERLINE='\e[4m'
###############

domain=$1
typeOfRecon=$2
cd ~/tools
dt=$(date +%F.%H.%M.%S)
resultDir=~/tools/results/$domain-$dt
echo -e "Results in : ${BOLD}$resultDir${NORMAL}"
mkdir -p $resultDir
ReconStartTime=$(date +%s)
check_finished()
{
    tool=$1         # tools="subfinder"
    toolOutput=$2   # toolOutput="subfinderOutput"
    toolScreen=$3   # toolScreen="subfinderScreen"
    echo -e "${LIGHT_YELLOW}Checking whether "$tool" finished working${NORMAL}"
    STARTTIME=$(date +%s)
    while : ;
    do
        sleep 5s # sleep for 5 seconds before again checking
        if [ -f $resultDir/$toolOutput.finished ]; then
            # Delete flag file
            rm $resultDir/$toolOutput.finished
            # kill screen
            screen -X -S $toolScreen quit
            echo -en "\rTime elapsed : $totalTime seconds"
            break;
        fi
        ENDTIME=$(date +%s)
        totalTime=$(( $ENDTIME-$STARTTIME ))
        echo -en "\rTime elapsed : ${BLINK}${LIGHT_GREEN}$totalTime${NORMAL} seconds"
    done
    echo ""
}

#################   SUBFINDER AND AMASS ################################
amassScreen=$domain-amass
screen -dmS $amassScreen bash
sleep 1
screen -S $amassScreen -X stuff "scripts/amass.sh $domain $resultDir
"
amassOutput=$domain.amass.txt

subfinderScreen=$domain-subfinder
screen -dmS $subfinderScreen bash
sleep 1
screen -S $subfinderScreen -X stuff "scripts/subfinder.sh $domain $resultDir
"
subfinderOutput=$domain.subfinder.txt
# check whether both subfinder and amass have completed their work
# close their screens
# then merge them using sort -u

STARTTIME=$(date +%s)
echo -e "${LIGHT_YELLOW}Checking whether subfinder and amass finished working${NORMAL}"
while : ;
do
    sleep 5s # sleep for 5 seconds before again checking
    if [ -f $resultDir/$subfinderOutput.finished ] && [ -f $resultDir/$amassOutput.finished ]; then
        rm $resultDir/$subfinderOutput.finished
        rm $resultDir/$amassOutput.finished
        # kill both screens
        screen -X -S $subfinderScreen quit
        screen -X -S $amassScreen quit

        # Put sorted results of both in one file
        sort -u $resultDir/$subfinderOutput $resultDir/$amassOutput > $resultDir/$domain.amass_subfinder.txt
        echo -en "\rTime elapsed : $totalTime seconds"
        break;
    fi
    ENDTIME=$(date +%s)
    totalTime=$(( $ENDTIME-$STARTTIME ))
    echo -en "\rTime elapsed : ${BLINK}${LIGHT_GREEN}$totalTime${NORMAL} seconds"
done
echo ""

echo -e "${LIGHT_GREEN}Done amass and subfinder${NORMAL}"

#################   SUBFINDER AND AMASS COMPLETE  #######################

############################ MASSDNS ####################################
echo -e "${LIGHT_YELLOW}Now doing massdns on the domain${NORMAL}"

massdns_ip_screen=$domain-massdns
screen -dmS $massdns_ip_screen bash
sleep 1
screen -S $domain-massdns -X stuff "scripts/massdns_ip.sh $domain $resultDir
"
# Do masscanning only when massdns is finished working
massdnsOutput=$domain.massdns_ip
check_finished "massdns_ip" $massdnsOutput $massdns_ip_screen

echo -e "${LIGHT_GREEN}Massdns complete${NORMAL}"
############################ MASSDNS COMPLETE ###########################

#################   SUBJACK  ##########################################
subjack_screen=$domain-subjack
subjackOutput=$domain.subjack

screen -dmS $subjack_screen bash
sleep 1
screen -S $subjack_screen -X stuff "scripts/subjack.sh $domain $resultDir
"
check_finished "subjack" $subjackOutput $subjack_screen
echo -e "${LIGHT_GREEN}Done subjack${NORMAL}"
#################   SUBJACK COMPLETE  #################################


############################ MASSCAN ####################################
echo -e "${LIGHT_YELLOW}Now doing masscan on all the obtained ip addreses from massdns${NORMAL}"

masscan_ip_screen=$domain-masscan-ips
screen -dmS $masscan_ip_screen bash
sleep 1
screen -S $masscan_ip_screen -X stuff "scripts/masscan.sh $resultDir/$domain.massdns_ip.ips.txt $domain $resultDir
"

masscanOutput=$domain.masscan
check_finished "masscan-ip" $masscanOutput $masscan_ip_screen
echo -e "${LIGHT_GREEN}Masscan complete${NORMAL}"
#################   MASSCAN COMPLETE  ####################################

#################   NMAP SORTED FILE PYTHON  #############################
echo -e "${LIGHT_YELLOW}Running python ~/tools/nmap-input-file-creator.py to create nmap suitable file${NORMAL}"
python ~/tools/nmap-input-file-creator.py $resultDir/$domain.masscan-sorted.txt $resultDir/$domain.nmap-sorted.txt
if [ $? -eq 0 ]; then
    echo -e "${LIGHT_YELLOW}Nmap input file created successfully${NORMAL}"
else
    exit 1
fi
nmapFile=$resultDir/$domain.nmap-sorted.txt
#################   NMAP SORTED FILE PYTHON COMPLETE  ###################

#################   NMAP  ###############################################
nmapOutput=$domain.nmap
nmapScreen=$domain-nmap
screen -dmS $nmapScreen bash
sleep 1
screen -S $nmapScreen -X stuff "scripts/nmap.sh $nmapFile $resultDir $domain $typeOfRecon
"
check_finished "nmap" $nmapOutput $nmapScreen
#################   NMAP COMPLETE  ######################################

#################   SEARCHSPLOIT  ###############################################
searchsploitOutput=$domain.searchsploit
searchsploitScreen=$domain-searchsploit
screen -dmS $searchsploitScreen bash
sleep 1
screen -S $searchsploitScreen -X stuff "scripts/searchsploit.sh $searchsploitFile $resultDir $domain $typeOfRecon
"
check_finished "searchsploit" $searchsploitOutput $searchsploitScreen
#################   SEARCHSPLOIT COMPLETE  ######################################


#################   AQUATONE  #########################################
#
# Run aquatone on only valid domains found using massdns
#
aquatone_screen=$domain-aquatone
aquatoneOutput=$domain.aquatone

screen -dmS $aquatone_screen bash
sleep 1
screen -S $aquatone_screen -X stuff "scripts/aquatone.sh $domain $resultDir $typeOfRecon
"
check_finished "aquatone" $aquatoneOutput $aquatone_screen
echo -e "${LIGHT_GREEN}Done aquatone${NORMAL}"
#################   AQUATONE COMPLETE  ################################

ReconEndTime=$(date +%s)

echo -e "${BOLD}${LIGHT_GREEN}Reconnaissance finished${NORMAL}"
echo -e "Results in : ${LIGHT_GREEN}$resultDir${NORMAL}"
cd $resultDir && zip "/var/www/html/$domain.zip" -r .
echo -e "${LIGHT_GREEN}" && tree $resultDir && echo -en "${NORMAL}"
echo -e "Download your zip from : ${BOLD}${LIGHT_GREEN}${UNDERLINE}http://$(curl ifconfig.co)/$domain.zip${NORMAL}"
echo -e "Total Time taken : ${LIGHT_GREEN} $(( $ReconEndTime-$ReconStartTime )) ${NORMAL}seconds"