webcopilote
v2.0-beta
Fonctionnalités • Installation • Utilisation • WebCopilot • Outils utilisés • Accusé de réception
WebCopilot est un outil d'automatisation conçu pour énumérer les sous-domaines de la cible et détecter les bugs à l'aide de différents outils open source.
Le script énumère d'abord tous les sous-domaines du domaine cible donné à l'aide d'assetfinder, sublister, subfinder, amass, findomain, hackertarget, riddler et crt, puis effectue l'énumération active des sous-domaines à l'aide de gobuster de la liste de mots SecLists, puis filtre tous les sous-domaines en direct à l'aide de dnsx, puis il extrait titres des sous-domaines à l'aide de httpx et recherche la prise de contrôle de sous-domaine à l'aide de subjack. Ensuite, il utilise gau/gauplus, waybackurls ou waymore pour explorer tous les points de terminaison des sous-domaines donnés, puis il utilise des modèles gf pour filtrer les paramètres xss, lfi, ssrf, sqli, open redirect et rce de ces sous-domaines donnés, puis il analyse pour les vulnérabilités sur les sous-domaines en utilisant différents outils open source (comme kxss, dalfox, openredirex, nuclei, etc). Ensuite, il imprimera le résultat de l'analyse et enregistrera toute la sortie dans un répertoire spécifié.
g ! 2m0: ~ webcopilot -h ──────▄▀▄─────▄▀▄
─────▄█░░▀▀▀▀▀░░█▄
─▄▄──█░░░░░░░░░░░█──▄▄
█▄▄█─█░░▀░░┬░░▀░░█─█▄▄█
██╗░░░░░░░██╗███████╗██████╗░░█████╗░░█████╗░██████╗░██╗██╗░░░░░░█████╗░████████╗
░██║░░██╗░░██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║██║░░░░░██╔══██╗╚══██╔══╝
░╚██╗████╗██╔╝█████╗░░██████╦╝██║░░╚═╝██║░░██║██████╔╝██║██║░░░░░██║░░██║░░░██║░░░
░░████╔═████║░██╔══╝░░██╔══██╗██║░░██╗██║░░██║██╔═══╝░██║██║░░░░░██║░░██║░░░██║░░░
░░╚██╔╝░╚██╔╝░███████╗██████╦╝╚█████╔╝╚█████╔╝██║░░░░░██║███████╗╚█████╔╝░░░██║░░░
░░░╚═╝░░░╚═╝░░╚══════╝╚═════╝░░╚════╝░░╚════╝░╚═╝░░░░░╚═╝╚══════╝░╚════╝░░░░╚═╝░░░
[ ● ] Version: 2.0 .0
[ ● ] @ h4r5h1t | G ! 2 m0
[ ] Warning: Use with caution . You are responsible for your own actions .
[ ] Developers assume no liability and are not responsible for any misuse or damage cause by this tool .
Usage :
webcopilot - d < target >
webcopilot - d < target > - a
webcopilot [ - d target ] [ - o output destination ] [ - t threads ] [ - b blind server URL ] [ - x exclude domains ] [ - f subdomains file ] [ - a ] [ - v ] [ - h ]
Flags :
- d Add your target [ Optional ]
- o To save outputs in folder [ Default : webcopilot - < timestamp > ]
-t Number of threads [Default: 100]
-b Add your server for BXSS [Default: False]
-x Exclude out of scope domains [Default: False]
-f Specify a file containing subdomains, this will skip subdomain enumeration [Optional]
-a Run all Enumeration by default it will run only subdomain enumeration [Default: False][Time Consuming]
-v Show version of the tool
-h Show this help message
Example:./webcopilot -d domain.com -a -o domain -t 333 -x exclude.txt -b testServer.oast.fun
You can use https://app.interactsh.com/ to get your serverWebCopilot nécessite que git soit installé avec succès. Exécutez la commande suivante en tant que root pour installer webcopilot
git clone https://github.com/h4r5h1t/webcopilot && cd webcopilot/ && chmod +x webcopilot install.sh && mv webcopilot /usr/bin/ && ./install.sh [ * ] Installing Tools
[ * ] Creating Directories
[ * ] Installing Dependencies and Checking is Installed or Not
[ * ] git is already installed
[ * ] python3 is already installed
[ * ] python3 - pip is already installed
[ * ] ruby is already installed
[ * ] golang - go is already installed
[ * ] snapd could not be found [ * ] Installing snapd
[ * ] snapd is not installed successfully , Please install it manually
[ * ] cmake is already installed
[ * ] jq is already installed
[ * ] gobuster is already installed
[ * ] chromium is already installed
[ * ] parallel is already installed
[ * ] Installing Python Tools
[ * ] Sublist3r could not be found [ * ] Installing Sublist3r
[ * ] Sublist3r is installed successfully
[ * ] sqlmap is already installed
[ * ] urldedupe is already installed
[ * ] openredirex is already installed
[ * ] waymore is already installed
[ * ] findomain is already installed
[ * ] uro is already installed
[ * ] Installing Wordlists and Payloads
[ * ] Skipping payloads / lfi . txt , already exists .
[ * ] Skipping resolvers . txt , already exists .
[ * ] Skipping subdomains . txt , already exists .
[ * ] Skipping fuzz . txt , already exists .
[ * ] Skipping dicc . txt , already exists .
[ * ] Skipping big . txt , already exists .
[ * ] Skipping dns . txt , already exists .
[ * ] Installing Go Tools
[ * ] anew is already installed
[ * ] gf is already installed
[ * ] aquatone could not be found [ * ] Installing aquatone
[ * ] aquatone is not installed successfully , Please install it manually
[ * ] assetfinder is already installed
[ * ] gau is already installed
[ * ] waybackurls is already installed
[ * ] httpx could not be found [ * ] Installing httpx
[ * ] httpx is not installed successfully , Please install it manually
[ * ] amass could not be found [ * ] Installing amass
[ * ] amass is not installed successfully , Please install it manually
[ * ] kxss is already installed
[ * ] subjack is already installed
[ * ] qsreplace is already installed
[ * ] dnsx could not be found [ * ] Installing dnsx
[ * ] dnsx is not installed successfully , Please install it manually
[ * ] dalfox is already installed
[ * ] crlfuzz is already installed
[ * ] nuclei could not be found [ * ] Installing nuclei
[ * ] nuclei is not installed successfully , Please install it manually
[ * ] subfinder could not be found [ * ] Installing subfinder
[ * ] subfinder is not installed successfully , Please install it manually
[ * ] Configuring Tools and Setting Up Environment
[ * ] All Tools are installed successfullySubFinder • Sublist3r • Findomain • gf • OpenRedireX • dnsx • sqlmap • gobuster • Assetfinder • httpx • kxss • qsreplace • Nuclei • dalfox • anew • jq • aquatone • urldedupe • Amass • gauplus • waybackurls • crlfuzz • gau • waymore • SUBLIST3R_V2. 0 • euros
Pour exécuter l'outil sur une cible, utilisez simplement la commande suivante.
g ! 2m0: ~ webcopilot -d example.com La commande -o peut être utilisée pour spécifier un répertoire de sortie.
g ! 2m0: ~ webcopilot -d example.com -o example La commande -a peut être utilisée pour exécuter toutes les énumérations (énumération de sous-domaines + analyse des vulnérabilités).
g ! 2m0: ~ webcopilot -d example.com -o example -a La commande -t peut être utilisée pour ajouter des threads à votre analyse pour un résultat plus rapide.
g ! 2m0: ~ webcopilot -d example.com -o example -t 333 La commande -b peut être utilisée pour blind xss (OOB), vous pouvez faire interagir votre serveur
g ! 2m0: ~ webcopilot -d example.com -o example -t 333 -b eeuyhzfnsezrraragtd70ex5oc2hsw.oast.fun La commande -x peut être utilisée pour exclure les domaines hors de portée.
g ! 2m0: ~ echo out.example.com > excludeDomain.txt
g ! 2m0: ~ webcopilot -d example.com -o example -t 333 -x excludeDomain.txt -b eeuyhzfnsezrraragtd70ex5oc2hsw.oast.fun La commande -f peut être utilisée pour transmettre un fichier contenant des sous-domaines (en utilisant cette énumération de saut de sous-domaine actif + passif)
g ! 2m0: ~ webcopilot -d example.com -o example -f /home/ubuntu/subdomains.txt -aLes options par défaut ressemblent à ceci :
g ! 2m0: ~ webcopilot -d http://testphp.vulnweb.com/ -a -b eeuyhzfpwgnsezrraragtd70ex5oc2hsw.oast.fun ──────▄▀▄─────▄▀▄
─────▄█░░▀▀▀▀▀░░█▄
─▄▄──█░░░░░░░░░░░█──▄▄
█▄▄█─█░░▀░░┬░░▀░░█─█▄▄█
██╗░░░░░░░██╗███████╗██████╗░░█████╗░░█████╗░██████╗░██╗██╗░░░░░░█████╗░████████╗
░██║░░██╗░░██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║██║░░░░░██╔══██╗╚══██╔══╝
░╚██╗████╗██╔╝█████╗░░██████╦╝██║░░╚═╝██║░░██║██████╔╝██║██║░░░░░██║░░██║░░░██║░░░
░░████╔═████║░██╔══╝░░██╔══██╗██║░░██╗██║░░██║██╔═══╝░██║██║░░░░░██║░░██║░░░██║░░░
░░╚██╔╝░╚██╔╝░███████╗██████╦╝╚█████╔╝╚█████╔╝██║░░░░░██║███████╗╚█████╔╝░░░██║░░░
░░░╚═╝░░░╚═╝░░╚══════╝╚═════╝░░╚════╝░░╚════╝░╚═╝░░░░░╚═╝╚══════╝░╚════╝░░░░╚═╝░░░
[ ● ] Version: 2.0 .0
[ ● ] @ h4r5h1t | G ! 2 m0
[ ] Warning: Use with caution . You are responsible for your own actions .
[ ] Developers assume no liability and are not responsible for any misuse or damage cause by this tool .
Target : http: //testphp.vulnweb.com/
Output: / home / ubuntu / github / webcopilot / webcopilot - 1714304809
Threads: 100
Server: eeuyhzfpwgnsezdyeragtd70ex5oc2hsw . oast . fun
Exclude: False
Mode: Running all Enumeration
Time : 28 - 04 - 2024 17 : 16 : 49
[ ! ] Please wait while scanning . . .
[ ● ] Passive Subdomain Scanning is in progress :
[ ● ] Subdomain Scanned - [ assetfinder✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ SUBLIST3R_V2 .0 ✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ subfinder✔ ] Subdomain Found : 1
[ ● ] Subdomain Scanned - [ amass✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ findomain✔ ] Subdomain Found : 1
[ ● ] Subdomain Scanned - [ crt . sh✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ hackertarget✔ ] Subdomain Found : 1
[ ● ] Subdomain Scanned - [ riddler✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ certspotter✔ ] Subdomain Found : 0
[ ● ] Active Subdomain Scanning is in progress :
[ ! ] Please be patient . This may take a while ...
[ ● ] Active Subdomain Scanned - [ gobuster✔ ] Subdomain Found : 0
[ ● ] Active Subdomain Scanned - [ amass✔ ] Subdomain Found : 0
[ ● ] Subdomain Filtering : Filtering Alive subdomains
[ ● ] Subdomain Filtering - Filtering alive subdomains is completed . Check : / subdomains / alivesub . txt
[ ● ] Subdomain Scanning : Getting titles of valid subdomains
[ ● ] Visual inspection of Subdomains is completed . Check : / subdomains / aquatone /
[ ● ] Subdomain Enumeration Completed . Total : 1 | Alive : 1
[ ● ] Endpoints Scanning Completed . Total : 0
[ ● ] Vulnerabilities Scanning is in progress : Getting all vulnerabilities of
[ ● ] Vulnerabilities Scanning is in progress :
[ ● ] Vulnerabilities Scanned - [ XSS✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ SQLi✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ LFI✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ CRLF✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ SSRF✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ Open redirect✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ Subdomain Takeover✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ Nuclie✔ ] Found : 0
[ ● ] Vulnerabilities Scanning Completed . Check : / vulnerabilities /
▒█▀▀█ █▀▀ █▀▀ █░░█ █░░ ▀▀█▀▀
▒█▄▄▀ █▀▀ ▀▀█ █░░█ █░░ ░░█░░
▒█░▒█ ▀▀▀ ▀▀▀ ░▀▀▀ ▀▀▀ ░░▀░░
[ + ] Subdomains of http : //testphp.vulnweb.com/
[ + ] Subdomains Found : 1
[ + ] Subdomains Alive : 1
[ + ] Endpoints : 0
[ + ] XSS : 0
[ + ] SQLi : 0
[ + ] Open Redirect : 0
[ + ] SSRF : 0
[ + ] CRLF : 0
[ + ] LFI : 0
[ + ] Subdomain Takeover : 0
[ + ] Nuclei : 0WebCopilot est inspiré de Garud & Pinaak par ROX4R.
@aboul3la @tomnomnom @lc @hahwul @projectdiscovery @maurosoria @shelld3v @devanshbatham @michenriksen @defparam @projectdiscovery @bp0lr @ameenmaali @sqlmapproject @dwisiswant0 @OWASP @OJ @Findomain @danielmiessler @1ndianl33t @ROX4R @xnl-h4ck3r @hxlxmjxbbxs @s0md3v
| Avertissement : les développeurs n'assument aucune responsabilité et ne sont pas responsables de toute mauvaise utilisation ou de tout dommage causé par cet outil. Alors soyez prudent car vous êtes responsable de vos propres actes. |
