ウェブコパイロット
v2.0-beta
機能 • インストール • 使用法 • WebCopilot • 使用したツール • 謝辞
WebCopilot は、さまざまなオープンソース ツールを使用してターゲットのサブドメインを列挙し、バグを検出するように設計された自動化ツールです。
スクリプトはまず、assetfinder、sublister、subfinder、amass、findomain、hackertarget、riddler、crt を使用して指定されたターゲット ドメインのすべてのサブドメインを列挙し、次に SecLists ワードリストの gobuster を使用してアクティブなサブドメインを列挙し、次に dnsx を使用してすべてのライブ サブドメインをフィルタリングして抽出します。 httpx を使用してサブドメインのタイトルを取得し、subjack を使用してサブドメインの乗っ取りをスキャンします。次に、gau/gauplus、waybackurls、または waymore を使用して、指定されたサブドメインのすべてのエンドポイントをクロールし、次に gf パターンを使用して、指定されたサブドメインから xss、lfi、ssrf、sqli、オープン リダイレクトおよび rce パラメータを除外し、スキャンします。さまざまなオープンソース ツール (kxss、dalfox、openredirex、nuclei、など）。次に、スキャンの結果を印刷し、すべての出力を指定されたディレクトリに保存します。
g ! 2m0: ~ webcopilot -h ──────▄▀▄─────▄▀▄
─────▄█░░▀▀▀▀▀░░█▄
─▄▄──█░░░░░░░░░░░█──▄▄
█▄▄█─█░░▀░░┬░░▀░░█─█▄▄█
██╗░░░░░░░██╗███████╗██████╗░░█████╗░░█████╗░██████╗░██╗██╗░░░░░░█████╗░████████╗
░██║░░██╗░░██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║██║░░░░░██╔══██╗╚══██╔══╝
░╚██╗████╗██╔╝█████╗░░██████╦╝██║░░╚═╝██║░░██║██████╔╝██║██║░░░░░██║░░██║░░░██║░░░
░░████╔═████║░██╔══╝░░██╔══██╗██║░░██╗██║░░██║██╔═══╝░██║██║░░░░░██║░░██║░░░██║░░░
░░╚██╔╝░╚██╔╝░███████╗██████╦╝╚█████╔╝╚█████╔╝██║░░░░░██║███████╗╚█████╔╝░░░██║░░░
░░░╚═╝░░░╚═╝░░╚══════╝╚═════╝░░╚════╝░░╚════╝░╚═╝░░░░░╚═╝╚══════╝░╚════╝░░░░╚═╝░░░
[ ● ] Version: 2.0 .0
[ ● ] @ h4r5h1t | G ! 2 m0
[ ] Warning: Use with caution . You are responsible for your own actions .
[ ] Developers assume no liability and are not responsible for any misuse or damage cause by this tool .
Usage :
webcopilot - d < target >
webcopilot - d < target > - a
webcopilot [ - d target ] [ - o output destination ] [ - t threads ] [ - b blind server URL ] [ - x exclude domains ] [ - f subdomains file ] [ - a ] [ - v ] [ - h ]
Flags :
- d Add your target [ Optional ]
- o To save outputs in folder [ Default : webcopilot - < timestamp > ]
-t Number of threads [Default: 100]
-b Add your server for BXSS [Default: False]
-x Exclude out of scope domains [Default: False]
-f Specify a file containing subdomains, this will skip subdomain enumeration [Optional]
-a Run all Enumeration by default it will run only subdomain enumeration [Default: False][Time Consuming]
-v Show version of the tool
-h Show this help message
Example:./webcopilot -d domain.com -a -o domain -t 333 -x exclude.txt -b testServer.oast.fun
You can use https://app.interactsh.com/ to get your serverWebCopilot を正常にインストールするにはgit が必要です。 rootとして次のコマンドを実行して、webcopilot をインストールします。
git clone https://github.com/h4r5h1t/webcopilot && cd webcopilot/ && chmod +x webcopilot install.sh && mv webcopilot /usr/bin/ && ./install.sh [ * ] Installing Tools
[ * ] Creating Directories
[ * ] Installing Dependencies and Checking is Installed or Not
[ * ] git is already installed
[ * ] python3 is already installed
[ * ] python3 - pip is already installed
[ * ] ruby is already installed
[ * ] golang - go is already installed
[ * ] snapd could not be found [ * ] Installing snapd
[ * ] snapd is not installed successfully , Please install it manually
[ * ] cmake is already installed
[ * ] jq is already installed
[ * ] gobuster is already installed
[ * ] chromium is already installed
[ * ] parallel is already installed
[ * ] Installing Python Tools
[ * ] Sublist3r could not be found [ * ] Installing Sublist3r
[ * ] Sublist3r is installed successfully
[ * ] sqlmap is already installed
[ * ] urldedupe is already installed
[ * ] openredirex is already installed
[ * ] waymore is already installed
[ * ] findomain is already installed
[ * ] uro is already installed
[ * ] Installing Wordlists and Payloads
[ * ] Skipping payloads / lfi . txt , already exists .
[ * ] Skipping resolvers . txt , already exists .
[ * ] Skipping subdomains . txt , already exists .
[ * ] Skipping fuzz . txt , already exists .
[ * ] Skipping dicc . txt , already exists .
[ * ] Skipping big . txt , already exists .
[ * ] Skipping dns . txt , already exists .
[ * ] Installing Go Tools
[ * ] anew is already installed
[ * ] gf is already installed
[ * ] aquatone could not be found [ * ] Installing aquatone
[ * ] aquatone is not installed successfully , Please install it manually
[ * ] assetfinder is already installed
[ * ] gau is already installed
[ * ] waybackurls is already installed
[ * ] httpx could not be found [ * ] Installing httpx
[ * ] httpx is not installed successfully , Please install it manually
[ * ] amass could not be found [ * ] Installing amass
[ * ] amass is not installed successfully , Please install it manually
[ * ] kxss is already installed
[ * ] subjack is already installed
[ * ] qsreplace is already installed
[ * ] dnsx could not be found [ * ] Installing dnsx
[ * ] dnsx is not installed successfully , Please install it manually
[ * ] dalfox is already installed
[ * ] crlfuzz is already installed
[ * ] nuclei could not be found [ * ] Installing nuclei
[ * ] nuclei is not installed successfully , Please install it manually
[ * ] subfinder could not be found [ * ] Installing subfinder
[ * ] subfinder is not installed successfully , Please install it manually
[ * ] Configuring Tools and Setting Up Environment
[ * ] All Tools are installed successfullySubFinder • Sublist3r • Findomain • gf • OpenRedireX • dnsx • sqlmap • gobuster •assetfinder • httpx • kxss • qsreplace • Nuclei • dalfox • anew • jq • aquatone • urldedupe • Amass • gauplus • waybackurls • crlfuzz • gau • waymore • SUBLIST3R_V2。 0・ウロ
ターゲット上でツールを実行するには、次のコマンドを使用するだけです。
g ! 2m0: ~ webcopilot -d example.com -oコマンドを使用して出力ディレクトリを指定できます。
g ! 2m0: ~ webcopilot -d example.com -o example -aコマンドは、すべての列挙 (サブドメイン列挙 + 脆弱性スキャン) を実行するために使用できます。
g ! 2m0: ~ webcopilot -d example.com -o example -a -tコマンドを使用すると、スキャンにスレッドを追加して結果を高速化できます。
g ! 2m0: ~ webcopilot -d example.com -o example -t 333 -bコマンドはブラインド xss (OOB) に使用でき、対話からサーバーを取得できます。
g ! 2m0: ~ webcopilot -d example.com -o example -t 333 -b eeuyhzfnsezrraragtd70ex5oc2hsw.oast.fun -xコマンドを使用すると、スコープ外のドメインを除外できます。
g ! 2m0: ~ echo out.example.com > excludeDomain.txt
g ! 2m0: ~ webcopilot -d example.com -o example -t 333 -x excludeDomain.txt -b eeuyhzfnsezrraragtd70ex5oc2hsw.oast.fun -fコマンドを使用して、サブドメインを含むファイルを渡すことができます (このスキップ アクティブ + パッシブ サブドメイン列挙を使用します)。
g ! 2m0: ~ webcopilot -d example.com -o example -f /home/ubuntu/subdomains.txt -aデフォルトのオプションは次のようになります。
g ! 2m0: ~ webcopilot -d http://testphp.vulnweb.com/ -a -b eeuyhzfpwgnsezrraragtd70ex5oc2hsw.oast.fun ──────▄▀▄─────▄▀▄
─────▄█░░▀▀▀▀▀░░█▄
─▄▄──█░░░░░░░░░░░█──▄▄
█▄▄█─█░░▀░░┬░░▀░░█─█▄▄█
██╗░░░░░░░██╗███████╗██████╗░░█████╗░░█████╗░██████╗░██╗██╗░░░░░░█████╗░████████╗
░██║░░██╗░░██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║██║░░░░░██╔══██╗╚══██╔══╝
░╚██╗████╗██╔╝█████╗░░██████╦╝██║░░╚═╝██║░░██║██████╔╝██║██║░░░░░██║░░██║░░░██║░░░
░░████╔═████║░██╔══╝░░██╔══██╗██║░░██╗██║░░██║██╔═══╝░██║██║░░░░░██║░░██║░░░██║░░░
░░╚██╔╝░╚██╔╝░███████╗██████╦╝╚█████╔╝╚█████╔╝██║░░░░░██║███████╗╚█████╔╝░░░██║░░░
░░░╚═╝░░░╚═╝░░╚══════╝╚═════╝░░╚════╝░░╚════╝░╚═╝░░░░░╚═╝╚══════╝░╚════╝░░░░╚═╝░░░
[ ● ] Version: 2.0 .0
[ ● ] @ h4r5h1t | G ! 2 m0
[ ] Warning: Use with caution . You are responsible for your own actions .
[ ] Developers assume no liability and are not responsible for any misuse or damage cause by this tool .
Target : http: //testphp.vulnweb.com/
Output: / home / ubuntu / github / webcopilot / webcopilot - 1714304809
Threads: 100
Server: eeuyhzfpwgnsezdyeragtd70ex5oc2hsw . oast . fun
Exclude: False
Mode: Running all Enumeration
Time : 28 - 04 - 2024 17 : 16 : 49
[ ! ] Please wait while scanning . . .
[ ● ] Passive Subdomain Scanning is in progress :
[ ● ] Subdomain Scanned - [ assetfinder✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ SUBLIST3R_V2 .0 ✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ subfinder✔ ] Subdomain Found : 1
[ ● ] Subdomain Scanned - [ amass✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ findomain✔ ] Subdomain Found : 1
[ ● ] Subdomain Scanned - [ crt . sh✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ hackertarget✔ ] Subdomain Found : 1
[ ● ] Subdomain Scanned - [ riddler✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ certspotter✔ ] Subdomain Found : 0
[ ● ] Active Subdomain Scanning is in progress :
[ ! ] Please be patient . This may take a while ...
[ ● ] Active Subdomain Scanned - [ gobuster✔ ] Subdomain Found : 0
[ ● ] Active Subdomain Scanned - [ amass✔ ] Subdomain Found : 0
[ ● ] Subdomain Filtering : Filtering Alive subdomains
[ ● ] Subdomain Filtering - Filtering alive subdomains is completed . Check : / subdomains / alivesub . txt
[ ● ] Subdomain Scanning : Getting titles of valid subdomains
[ ● ] Visual inspection of Subdomains is completed . Check : / subdomains / aquatone /
[ ● ] Subdomain Enumeration Completed . Total : 1 | Alive : 1
[ ● ] Endpoints Scanning Completed . Total : 0
[ ● ] Vulnerabilities Scanning is in progress : Getting all vulnerabilities of
[ ● ] Vulnerabilities Scanning is in progress :
[ ● ] Vulnerabilities Scanned - [ XSS✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ SQLi✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ LFI✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ CRLF✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ SSRF✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ Open redirect✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ Subdomain Takeover✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ Nuclie✔ ] Found : 0
[ ● ] Vulnerabilities Scanning Completed . Check : / vulnerabilities /
▒█▀▀█ █▀▀ █▀▀ █░░█ █░░ ▀▀█▀▀
▒█▄▄▀ █▀▀ ▀▀█ █░░█ █░░ ░░█░░
▒█░▒█ ▀▀▀ ▀▀▀ ░▀▀▀ ▀▀▀ ░░▀░░
[ + ] Subdomains of http : //testphp.vulnweb.com/
[ + ] Subdomains Found : 1
[ + ] Subdomains Alive : 1
[ + ] Endpoints : 0
[ + ] XSS : 0
[ + ] SQLi : 0
[ + ] Open Redirect : 0
[ + ] SSRF : 0
[ + ] CRLF : 0
[ + ] LFI : 0
[ + ] Subdomain Takeover : 0
[ + ] Nuclei : 0WebCopilot は、ROX4R の Garud と Pinaak からインスピレーションを受けています。
@aboul3la @tomnomnom @lc @hahwul @projectdiscovery @maurosoria @shelld3v @devanshbatham @michenriksen @defparam @projectdiscovery @bp0lr @ameenmaali @sqlmapproject @dwisiswant0 @OWASP @OJ @Findomain @danielmiessler @1ndianl33t @ROX4R @xnl-h4ck3r @hxlxmjxbbxs @s0md3v
| 警告:開発者は、このツールによって引き起こされる誤用または損害に対して一切の責任を負いません。したがって、自分の行動は自分で責任を負いますので、慎重に行ってください。 |
