Skip to content
This repository was archived by the owner on Dec 16, 2022. It is now read-only.

Added [USER_AGENT] variable usage to most HTTP/HTTPS commands #141

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Added [USER_AGENT] variable usage to most HTTP/HTTPS commands #141

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 37 additions & 37 deletions setup/config_default.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ PASSWORD_SHORT_LIST : /path/to/list
PASSWORD_LONG_LIST : /path/to/list
MY_CUSTOM_LIST : /path/to/list
COOKIES : foo=bar
USER_AGENT : celerystalk
USER_AGENT : "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

; Note: [OUTPUT] expands to /output_directory/TARGET/TARGET_PORT_toolname
; Example: /pentest/hackTheBox/10.10.10.10/10.10.10.10_80_cewl
Expand Down Expand Up @@ -115,56 +115,56 @@ aquatone : /opt/aquatone/aquatone -out [OUTPUT] -resolution "800,600
; commands. To use USER_AGENT, place [USER_AGENT] in the command line
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
[http]
whatweb-3 : whatweb http://[TARGET]:[PORT]/[PATH] -a3 --colour=never | sed s/],/]\\n/g | tee [OUTPUT].txt
photon : python3 /opt/Photon/photon.py -u http://[TARGET]:[PORT]/[PATH] -o [OUTPUT] -e json && cat [OUTPUT]/exported.json | tee [OUTPUT].txt
wayback : curl -sX GET "http://web.archive.org/cdx/search/cdx?url=http://[TARGET]:[PORT]/[PATH]&output=text&fl=original&collapse=urlkey&matchType=prefix" | tee [OUTPUT].txt
cewl : cewl http://[TARGET]:[PORT]/[PATH] -m 6 -w [OUTPUT].txt
nikto : nikto -h http://[TARGET]:[PORT]/[PATH] -output [OUTPUT].txt
wpscan : wpscan --url http://[TARGET]:[PORT]/[PATH] --disable-tls-checks --no-banner -f cli-no-color --enumerate p t tt u | tee [OUTPUT].txt
gobuster_common : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web-Content/common.txt -s '200,204,302,307,403,500' -e -n -q | tee [OUTPUT].txt
gobuster_cmn_w_slash: gobuster dir -u http://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web-Content/common.txt -s '200,204,302,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_robots_dis : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web-Content/RobotsDisallowed-Top1000.txt -s '200,204,302,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_robots_slash : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web-Content/RobotsDisallowed-Top1000.txt -s '200,204,302,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_2.3-medium : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -s '200,204,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_2.3-md_slash : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -s '200,204,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_cgis : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web_Content/cgis.txt -s '200,204,301,307,403,500' -e -n -q > '[OUTPUT].txt
;gobuster_cgis_w_sl : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web_Content/cgis.txt -s '200,204,301,307,403,500' -e -n -q > '[OUTPUT].txt
whatweb-3 : whatweb http://[TARGET]:[PORT]/[PATH] -a3 --colour=never --user-agent=[USER_AGENT] | sed s/],/]\\n/g | tee [OUTPUT].txt
photon : python3 /opt/Photon/photon.py -u http://[TARGET]:[PORT]/[PATH] -o [OUTPUT] -e json --user-agent=[USER_AGENT] && cat [OUTPUT]/exported.json | tee [OUTPUT].txt
wayback : curl -sX GET "http://web.archive.org/cdx/search/cdx?url=http://[TARGET]:[PORT]/[PATH]&output=text&fl=original&collapse=urlkey&matchType=prefix" --user-agent=[USER_AGENT] | tee [OUTPUT].txt
cewl : cewl http://[TARGET]:[PORT]/[PATH] -m 6 -w [OUTPUT].txt --ua=[USER_AGENT]
nikto : nikto -h http://[TARGET]:[PORT]/[PATH] -output [OUTPUT].txt -useragent [USER_AGENT]
wpscan : wpscan --url http://[TARGET]:[PORT]/[PATH] --disable-tls-checks --no-banner -f cli-no-color --enumerate p t tt u --user-agent=[USER_AGENT] | tee [OUTPUT].txt
gobuster_common : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web-Content/common.txt -s '200,204,302,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
gobuster_cmn_w_slash: gobuster dir -u http://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web-Content/common.txt -s '200,204,302,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_robots_dis : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web-Content/RobotsDisallowed-Top1000.txt -s '200,204,302,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_robots_slash : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web-Content/RobotsDisallowed-Top1000.txt -s '200,204,302,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_2.3-medium : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -s '200,204,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_2.3-md_slash : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -s '200,204,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_cgis : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web_Content/cgis.txt -s '200,204,301,307,403,500' -e -n -q --useragent=[USER_AGENT] > '[OUTPUT].txt
;gobuster_cgis_w_sl : gobuster dir -u http://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web_Content/cgis.txt -s '200,204,301,307,403,500' -e -n -q --useragent=[USER_AGENT] > '[OUTPUT].txt
;wappalyzer_cli : docker run --rm wappalyzer/cli http://[TARGET]:[PORT]/[PATH] | jq . | tee [OUTPUT].txt
;whatweb-4 : whatweb http://[TARGET]:[PORT]/[PATH] -a4 --colour=never | sed s/],/]\\n/g | tee [OUTPUT].txt
;sqlmap : sqlmap -u http://[TARGET]:[PORT]/[PATH] --batch --crawl=5 --level 1 --risk 1 -f -a --smart -v0 --disable-coloring | tee [OUTPUT].txt
;whatweb-4 : whatweb http://[TARGET]:[PORT]/[PATH] -a4 --colour=never --user-agent=[USER_AGENT] | sed s/],/]\\n/g | tee [OUTPUT].txt
;sqlmap : sqlmap -u http://[TARGET]:[PORT]/[PATH] --batch --crawl=5 --level 1 --risk 1 -f -a --smart -v0 --disable-coloring -A [USER_AGENT] | tee [OUTPUT].txt
;curl_robots : curl http://[TARGET]:[PORT]/[PATH]/robots.txt --user-agent 'Googlebot/2.1 (+http://www.google.com/bot.html)' --connect-timeout 30 --max-time 180 | tee [OUTPUT].txt
;nmap_https_vanquish : nmap [TARGET] -p [PORT] -Pn --script='http* and not (broadcast or dos or external or http-slowloris* or fuzzer)' -oN [output].txt --host-timeout 40m --script-timeout 20m
;nmap_http_vuln : nmap -sC -sV -Pn -v -p [PORT] --script=http-vuln* --script-args http-vuln-cve2014-3704.cmd="uname -a",http-vuln-cve2014-3704.uri="/drupal" [TARGET] -oN [OUTPUT].txt --host-timeout 40m --script-timeout 20m
;nmap_script_http : nmap -sC -sV -Pn -v -p [PORT] --script=http-* [TARGET] -d -oN [OUTPUT].txt -oX [OUTPUT].xml --host-timeout 120m --script-timeout 20m
;curl_main : curl -i http:/[TARGET]:[PORT]/[PATH] -o [OUTPUT].txt
;cmsmap : cmsmap http://[TARGET]:[PORT]/[PATH] -s -t3 -o [OUTPUT].txt
;curl_main : curl -i http:/[TARGET]:[PORT]/[PATH] -o [OUTPUT].txt --user-agent=[USER_AGENT]
;cmsmap : cmsmap http://[TARGET]:[PORT]/[PATH] -s -t3 -o [OUTPUT].txt --agent=[USER_AGENT]

[https]
whatweb-3 : whatweb https://[TARGET]:[PORT]/[PATH] -a3 --colour=never | sed s/],/]\\n/g | tee [OUTPUT].txt
photon : python3 /opt/Photon/photon.py -u https://[TARGET]:[PORT]/[PATH] -o [OUTPUT] -e json && cat [OUTPUT]/exported.json | tee [OUTPUT].txt
wayback : curl -sX GET "http://web.archive.org/cdx/search/cdx?url=http://[TARGET]:[PORT]/[PATH]&output=text&fl=original&collapse=urlkey&matchType=prefix" | tee [OUTPUT].txt
cewl : cewl https://[TARGET]:[PORT]/[PATH] -m 6 -w [OUTPUT].txt
nikto : nikto -h https://[TARGET]:[PORT]/[PATH] -ssl -output [OUTPUT].txt
wpscan : wpscan --url https://[TARGET]:[PORT]/[PATH] --disable-tls-checks --no-banner -f cli-no-color --enumerate p t tt u | tee [OUTPUT].txt
gobuster_common : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web-Content/common.txt -s '200,204,302,307,403,500' -e -n -q | tee [OUTPUT].txt
gobuster_cm_w_slash : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web-Content/common.txt -s '200,204,302,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_2.3-medium : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -s '200,204,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_2.3-md_slash : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -s '200,204,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_robots1 : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web-Content/RobotsDisallowed-Top1000.txt -s '200,204,302,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_robots_slash : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web-Content/RobotsDisallowed-Top1000.txt -s '200,204,302,307,403,500' -e -n -q | tee [OUTPUT].txt
;gobuster_cgis : gobuster dir -u https://[TARGET]:[PORT]/ -k -w /usr/share/seclists/Discovery/Web_Content/cgis.txt -s '200,204,301,307,403,500' -e -n -q > '[OUTPUT].txt
;gobuster_cgis_slash : gobuster dir -u https://[TARGET]:[PORT]/ -f -k -w /usr/share/seclists/Discovery/Web_Content/cgis.txt -s '200,204,301,307,403,500' -e -n -q > '[OUTPUT].txt
whatweb-3 : whatweb https://[TARGET]:[PORT]/[PATH] -a3 --colour=never --user-agent=[USER_AGENT] | sed s/],/]\\n/g | tee [OUTPUT].txt
photon : python3 /opt/Photon/photon.py -u https://[TARGET]:[PORT]/[PATH] -o [OUTPUT] -e json --user-agent=[USER_AGENT] && cat [OUTPUT]/exported.json | tee [OUTPUT].txt
wayback : curl -sX GET "http://web.archive.org/cdx/search/cdx?url=http://[TARGET]:[PORT]/[PATH]&output=text&fl=original&collapse=urlkey&matchType=prefix" --user-agent=[USER_AGENT] | tee [OUTPUT].txt
cewl : cewl https://[TARGET]:[PORT]/[PATH] -m 6 -w [OUTPUT].txt --ua=[USER_AGENT]
nikto : nikto -h https://[TARGET]:[PORT]/[PATH] -ssl -output [OUTPUT].txt -useragent [USER_AGENT]
wpscan : wpscan --url https://[TARGET]:[PORT]/[PATH] --disable-tls-checks --no-banner -f cli-no-color --enumerate p t tt u --user-agent=[USER_AGENT] | tee [OUTPUT].txt
gobuster_common : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web-Content/common.txt -s '200,204,302,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
gobuster_cm_w_slash : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web-Content/common.txt -s '200,204,302,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_2.3-medium : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -s '200,204,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_2.3-md_slash : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -s '200,204,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_robots1 : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -k -w /usr/share/seclists/Discovery/Web-Content/RobotsDisallowed-Top1000.txt -s '200,204,302,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_robots_slash : gobuster dir -u https://[TARGET]:[PORT]/[PATH] -f -k -w /usr/share/seclists/Discovery/Web-Content/RobotsDisallowed-Top1000.txt -s '200,204,302,307,403,500' -e -n -q --useragent=[USER_AGENT] | tee [OUTPUT].txt
;gobuster_cgis : gobuster dir -u https://[TARGET]:[PORT]/ -k -w /usr/share/seclists/Discovery/Web_Content/cgis.txt -s '200,204,301,307,403,500' -e -n -q --useragent=[USER_AGENT] > '[OUTPUT].txt
;gobuster_cgis_slash : gobuster dir -u https://[TARGET]:[PORT]/ -f -k -w /usr/share/seclists/Discovery/Web_Content/cgis.txt -s '200,204,301,307,403,500' -e -n -q --useragent=[USER_AGENT] > '[OUTPUT].txt
;wappalyzer_cli : docker run --rm wappalyzer/cli https://[TARGET]:[PORT]/[PATH] | jq . | tee [OUTPUT].txt
;whatweb-4 : whatweb https://[TARGET]:[PORT]/[PATH] -a4 --colour=never | sed s/],/]\\n/g | tee [OUTPUT].txt
;sqlmap : sqlmap -u https://[TARGET]:[PORT]/[PATH] --batch --crawl=5 --level 1 --risk 1 -f -a --smart -v0 --disable-coloring | tee [OUTPUT].txt
;whatweb-4 : whatweb https://[TARGET]:[PORT]/[PATH] -a4 --colour=never --user-agent=[USER_AGENT] | sed s/],/]\\n/g | tee [OUTPUT].txt
;sqlmap : sqlmap -u https://[TARGET]:[PORT]/[PATH] --batch --crawl=5 --level 1 --risk 1 -f -a --smart -v0 --disable-coloring -A [USER_AGENT] | tee [OUTPUT].txt
;curl_robots : curl https://[TARGET]:[PORT]/[PATH]/robots.txt --user-agent 'Googlebot/2.1 (+http://www.google.com/bot.html)' --connect-timeout 30 --max-time 180 | tee [OUTPUT].txt
;nmap_https_vuln : nmap [TARGET] -p [PORT] -sC -sV -Pn --script=http-vuln* --script-args http-vuln-cve2014-3704.cmd="uname -a",http-vuln-cve2014-3704.uri="/drupal" [TARGET] -oN [OUTPUT].txt --host-timeout 40m --script-timeout 20m
;nmap_https_vanquish : nmap [TARGET] -p [PORT] --script='(http* or ssl*) and not (broadcast or dos or external or http-slowloris* or fuzzer)' -oN [output].txt --host-timeout 20m --script-timeout 20m
;nmap_all_http : nmap -sC -sV -Pn -v -p [PORT] --script=http-* [TARGET] -d -oN [OUTPUT].txt -oX [OUTPUT].xml --host-timeout 120m --script-timeout 20m
;curl_main : curl -i https://[TARGET]:[PORT] -o [OUTPUT].txt
;curl_main : curl -i https://[TARGET]:[PORT] -o [OUTPUT].txt --user-agent=[USER_AGENT]
;sslscan : sslscan --no-colour [TARGET]:[PORT] | tee [OUTPUT].txt
;sslyze : sslyze [TARGET]:[PORT] --resum --certinfo=basic --compression --reneg --sslv2 --sslv3 --hide_rejected_ciphers >| tee [OUTPUT].txt
;cmsmap : cmsmap https://[TARGET]:[PORT]/[PATH] -s -t3 -o [OUTPUT].txt
;cmsmap : cmsmap https://[TARGET]:[PORT]/[PATH] -s -t3 -o [OUTPUT].txt --agent=[USER_AGENT]

[ftp]
nmap_scripts : nmap [TARGET] -sC -sV -Pn -vv -p[PORT] --script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-syst,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221 -oN [OUTPUT].txt
Expand Down