Skip to content

Commit 89ac626

Browse files
strikoderstrikoder
authored
Create webEnum.sh
1 parent 88d0ff0 commit 89ac626

1 file changed

Lines changed: 118 additions & 0 deletions

File tree

‎bugBounty/webEnum.sh‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
#!/bin/bash
2+
3+
# === [ Input Check ] ===
4+
url=$1
5+
if [ -z "$url" ]; then
6+
echo "Usage: $0 <domain.com>"
7+
exit 1
8+
fi
9+
10+
# === [ Dependency Check ] ===
11+
REQUIRED_TOOLS=(subfinder amass findomain dnsx httpx gowitness subjack waybackurls whatweb)
12+
for tool in "${REQUIRED_TOOLS[@]}"; do
13+
if ! command -v $tool &> /dev/null; then
14+
echo "[-] $tool is required but not installed."
15+
exit 1
16+
fi
17+
done
18+
19+
# === [ Dir Setup ] ===
20+
mkdir -p $url/recon/{scans,httprobe,potential_takeovers,wayback/{params,extensions},whatweb,gowitness,thirdlvl}
21+
> $url/recon/httprobe/alive.txt
22+
> $url/recon/final.txt
23+
24+
# === [ Subdomain Enumeration ] ===
25+
echo "[+] Running subfinder, amass, and findomain..."
26+
subfinder -d $url -silent >> $url/recon/final.txt
27+
amass enum -passive -d $url >> $url/recon/final.txt
28+
findomain -t $url -q >> $url/recon/final.txt
29+
sort -u $url/recon/final.txt -o $url/recon/final.txt
30+
31+
# === [ 3rd Level Domains ] ===
32+
echo "[+] Extracting 3rd-level domains..."
33+
cat $url/recon/final.txt | grep -Po '([\w.-]+\.[\w-]+\.[\w-]+)$' | sort -u > $url/recon/thirdlvl/3rdlvl.txt
34+
35+
# === [ Subdomain Enumeration for 3rd Levels ] ===
36+
echo "[+] Running sublist3r on 3rd-level domains..."
37+
for domain in $(cat $url/recon/thirdlvl/3rdlvl.txt); do
38+
sublist3r -d $domain -o $url/recon/thirdlvl/$domain.txt
39+
cat $url/recon/thirdlvl/$domain.txt >> $url/recon/final.txt
40+
sort -u $url/recon/final.txt -o $url/recon/final.txt
41+
done
42+
43+
# === [ DNS Resolution + HTTP Probing ] ===
44+
echo "[+] Validating DNS with dnsx..."
45+
dnsx -silent -l $url/recon/final.txt > $url/recon/httprobe/resolved.txt
46+
47+
echo "[+] Probing HTTP services with httpx..."
48+
httpx -silent -l $url/recon/httprobe/resolved.txt | sed 's|https\?://||g' | sort -u > $url/recon/httprobe/alive.txt
49+
50+
echo "========================================"
51+
echo "Hint: search for stag, admin, dev, test in alive.txt"
52+
echo "========================================"
53+
54+
# === [ Subdomain Takeover Check ] ===
55+
echo "[+] Checking for subdomain takeover with subjack..."
56+
subjack -w $url/recon/httprobe/alive.txt -t 100 -timeout 30 -ssl \
57+
-c ~/go/src/github.com/haccer/subjack/fingerprints.json -v 3 \
58+
-o $url/recon/potential_takeovers/potential_takeovers.txt
59+
60+
# === [ WhatWeb Analysis ] ===
61+
echo "[+] Scanning with WhatWeb..."
62+
for domain in $(cat $url/recon/httprobe/alive.txt); do
63+
mkdir -p $url/recon/whatweb/$domain
64+
whatweb --info-plugins -t 50 -v $domain > $url/recon/whatweb/$domain/plugins.txt
65+
whatweb -t 50 -v $domain > $url/recon/whatweb/$domain/output.txt
66+
sleep 3
67+
done
68+
69+
# === [ Wayback Machine Collection ] ===
70+
echo "[+] Collecting Wayback URLs..."
71+
waybackurls < $url/recon/final.txt | sort -u > $url/recon/wayback/wayback_output.txt
72+
73+
# === [ Wayback Param Extraction ] ===
74+
echo "[+] Extracting parameters from Wayback..."
75+
grep -oP '\?.*?=' $url/recon/wayback/wayback_output.txt | cut -d '=' -f 1 | sort -u > $url/recon/wayback/params/wayback_params.txt
76+
77+
# === [ Extension Filtering ] ===
78+
echo "[+] Extracting file types from Wayback..."
79+
while read line; do
80+
ext="${line##*.}"
81+
case "$ext" in
82+
js) echo $line >> $url/recon/wayback/extensions/js.txt;;
83+
html|jsp) echo $line >> $url/recon/wayback/extensions/jsp.txt;;
84+
json) echo $line >> $url/recon/wayback/extensions/json.txt;;
85+
php) echo $line >> $url/recon/wayback/extensions/php.txt;;
86+
aspx) echo $line >> $url/recon/wayback/extensions/aspx.txt;;
87+
esac
88+
done < $url/recon/wayback/wayback_output.txt
89+
90+
# === [ Port Scanning ] ===
91+
#echo "[+] Scanning ports with nmap..."
92+
# nmap -iL $url/recon/httprobe/alive.txt -T4 -oA $url/recon/scans/scanned
93+
echo "[+] Scanning ports with nmap is commented out for time purposes, if you have time, uncomment and let it scans..."
94+
95+
96+
# === [ Screenshots ] ===
97+
echo "[+] Capturing screenshots with GoWitness..."
98+
gowitness file -f $url/recon/httprobe/alive.txt \
99+
--timeout 5 --threads 10 --log-level error \
100+
--destination $url/recon/gowitness
101+
102+
echo "[✓] Recon complete for $url."
103+
echo
104+
echo "[ℹ️] Recon complete. Check the following directories:"
105+
echo " ├─ $url/recon/final.txt → All discovered subdomains"
106+
echo " ├─ $url/recon/httprobe/alive.txt → DNS-resolved & alive HTTP(s) hosts"
107+
echo " ├─ $url/recon/potential_takeovers/ → Possible subdomain takeover info"
108+
echo " ├─ $url/recon/wayback/wayback_output.txt→ Archived URLs from Wayback Machine"
109+
echo " ├─ $url/recon/wayback/params/ → Possible URL parameters"
110+
echo " ├─ $url/recon/wayback/extensions/ → Interesting files (js, json, php, etc.)"
111+
echo " ├─ $url/recon/scans/scanned.* → Nmap port scan results"
112+
echo " ├─ $url/recon/gowitness/ → Screenshots of alive hosts"
113+
echo " ├─ $url/recon/whatweb/ → Tech fingerprinting results"
114+
echo " ├─ $url/recon/thirdlvl/ → 3rd-level subdomains enumerated"
115+
echo
116+
echo "[✓] All recon data saved under: $url/recon/"
117+
118+
exit 0

0 commit comments

Comments
 (0)