웹코파일럿
v2.0-beta
특징 • 설치 • 사용법 • WebCopilot • 사용된 도구 • 승인
WebCopilot 은 대상의 하위 도메인을 열거하고 다양한 오픈 소스 도구를 사용하여 버그를 감지하도록 설계된 자동화 도구입니다.
스크립트는 먼저 Assetfinder, sublister, subfinder, amass, findomain, hackertarget, 수수께끼 및 crt를 사용하여 지정된 대상 도메인의 모든 하위 도메인을 열거한 다음 SecLists wordlist의 gobuster를 사용하여 활성 하위 도메인 열거를 수행한 다음 dnsx를 사용하여 모든 라이브 하위 도메인을 필터링한 다음 추출합니다. httpx를 사용하여 하위 도메인의 제목을 검색하고 subjack을 사용하여 하위 도메인 인수를 검색합니다. 그런 다음 gau/gauplus, waybackurls 또는 waymore를 사용하여 지정된 하위 도메인의 모든 엔드포인트를 크롤링한 다음 gf 패턴을 사용하여 해당 하위 도메인에서 xss, lfi, ssrf, sqli, 오픈 리디렉션 및 rce 매개변수를 필터링한 다음 스캔합니다. 다양한 오픈 소스 도구(예: kxss, dalfox, openredirex, nuclei 등)를 사용하여 하위 도메인의 취약점을 확인합니다. 그런 다음 스캔 결과를 인쇄하고 모든 출력을 지정된 디렉터리에 저장합니다.
g ! 2m0: ~ webcopilot -h ──────▄▀▄─────▄▀▄
─────▄█░░▀▀▀▀▀░░█▄
─▄▄──█░░░░░░░░░░░█──▄▄
█▄▄█─█░░▀░░┬░░▀░░█─█▄▄█
██╗░░░░░░░██╗███████╗██████╗░░█████╗░░█████╗░██████╗░██╗██╗░░░░░░█████╗░████████╗
░██║░░██╗░░██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║██║░░░░░██╔══██╗╚══██╔══╝
░╚██╗████╗██╔╝█████╗░░██████╦╝██║░░╚═╝██║░░██║██████╔╝██║██║░░░░░██║░░██║░░░██║░░░
░░████╔═████║░██╔══╝░░██╔══██╗██║░░██╗██║░░██║██╔═══╝░██║██║░░░░░██║░░██║░░░██║░░░
░░╚██╔╝░╚██╔╝░███████╗██████╦╝╚█████╔╝╚█████╔╝██║░░░░░██║███████╗╚█████╔╝░░░██║░░░
░░░╚═╝░░░╚═╝░░╚══════╝╚═════╝░░╚════╝░░╚════╝░╚═╝░░░░░╚═╝╚══════╝░╚════╝░░░░╚═╝░░░
[ ● ] Version: 2.0 .0
[ ● ] @ h4r5h1t | G ! 2 m0
[ ] Warning: Use with caution . You are responsible for your own actions .
[ ] Developers assume no liability and are not responsible for any misuse or damage cause by this tool .
Usage :
webcopilot - d < target >
webcopilot - d < target > - a
webcopilot [ - d target ] [ - o output destination ] [ - t threads ] [ - b blind server URL ] [ - x exclude domains ] [ - f subdomains file ] [ - a ] [ - v ] [ - h ]
Flags :
- d Add your target [ Optional ]
- o To save outputs in folder [ Default : webcopilot - < timestamp > ]
-t Number of threads [Default: 100]
-b Add your server for BXSS [Default: False]
-x Exclude out of scope domains [Default: False]
-f Specify a file containing subdomains, this will skip subdomain enumeration [Optional]
-a Run all Enumeration by default it will run only subdomain enumeration [Default: False][Time Consuming]
-v Show version of the tool
-h Show this help message
Example:./webcopilot -d domain.com -a -o domain -t 333 -x exclude.txt -b testServer.oast.fun
You can use https://app.interactsh.com/ to get your serverWebCopilot을 성공적으로 설치하려면 git이 필요합니다. webcopilot을 설치하려면 루트 로 다음 명령을 실행하십시오.
git clone https://github.com/h4r5h1t/webcopilot && cd webcopilot/ && chmod +x webcopilot install.sh && mv webcopilot /usr/bin/ && ./install.sh [ * ] Installing Tools
[ * ] Creating Directories
[ * ] Installing Dependencies and Checking is Installed or Not
[ * ] git is already installed
[ * ] python3 is already installed
[ * ] python3 - pip is already installed
[ * ] ruby is already installed
[ * ] golang - go is already installed
[ * ] snapd could not be found [ * ] Installing snapd
[ * ] snapd is not installed successfully , Please install it manually
[ * ] cmake is already installed
[ * ] jq is already installed
[ * ] gobuster is already installed
[ * ] chromium is already installed
[ * ] parallel is already installed
[ * ] Installing Python Tools
[ * ] Sublist3r could not be found [ * ] Installing Sublist3r
[ * ] Sublist3r is installed successfully
[ * ] sqlmap is already installed
[ * ] urldedupe is already installed
[ * ] openredirex is already installed
[ * ] waymore is already installed
[ * ] findomain is already installed
[ * ] uro is already installed
[ * ] Installing Wordlists and Payloads
[ * ] Skipping payloads / lfi . txt , already exists .
[ * ] Skipping resolvers . txt , already exists .
[ * ] Skipping subdomains . txt , already exists .
[ * ] Skipping fuzz . txt , already exists .
[ * ] Skipping dicc . txt , already exists .
[ * ] Skipping big . txt , already exists .
[ * ] Skipping dns . txt , already exists .
[ * ] Installing Go Tools
[ * ] anew is already installed
[ * ] gf is already installed
[ * ] aquatone could not be found [ * ] Installing aquatone
[ * ] aquatone is not installed successfully , Please install it manually
[ * ] assetfinder is already installed
[ * ] gau is already installed
[ * ] waybackurls is already installed
[ * ] httpx could not be found [ * ] Installing httpx
[ * ] httpx is not installed successfully , Please install it manually
[ * ] amass could not be found [ * ] Installing amass
[ * ] amass is not installed successfully , Please install it manually
[ * ] kxss is already installed
[ * ] subjack is already installed
[ * ] qsreplace is already installed
[ * ] dnsx could not be found [ * ] Installing dnsx
[ * ] dnsx is not installed successfully , Please install it manually
[ * ] dalfox is already installed
[ * ] crlfuzz is already installed
[ * ] nuclei could not be found [ * ] Installing nuclei
[ * ] nuclei is not installed successfully , Please install it manually
[ * ] subfinder could not be found [ * ] Installing subfinder
[ * ] subfinder is not installed successfully , Please install it manually
[ * ] Configuring Tools and Setting Up Environment
[ * ] All Tools are installed successfullySubFinder • Sublist3r • Findomain • gf • OpenRedireX • dnsx • sqlmap • gobuster • Assetfinder • httpx • kxss • qsreplace • Nuclei • dalfox • anew • jq • aquatone • urldedupe • Amass • gauplus • waybackurls • crlfuzz • gau • waymore • SUBLIST3R_V2. 0 • 유로
대상에서 도구를 실행하려면 다음 명령을 사용하십시오.
g ! 2m0: ~ webcopilot -d example.com -o 명령을 사용하여 출력 디렉터리를 지정할 수 있습니다.
g ! 2m0: ~ webcopilot -d example.com -o example -a 명령은 모든 열거(하위 도메인 열거 + 취약점 검색)를 실행하는 데 사용할 수 있습니다.
g ! 2m0: ~ webcopilot -d example.com -o example -a -t 명령을 사용하면 더 빠른 결과를 위해 스캔에 스레드를 추가할 수 있습니다.
g ! 2m0: ~ webcopilot -d example.com -o example -t 333 -b 명령은 블라인드 xss(OOB)에 사용할 수 있으며, 상호작용에서 서버를 가져올 수 있습니다.
g ! 2m0: ~ webcopilot -d example.com -o example -t 333 -b eeuyhzfnsezrraragtd70ex5oc2hsw.oast.fun -x 명령을 사용하여 범위 밖의 도메인을 제외할 수 있습니다.
g ! 2m0: ~ echo out.example.com > excludeDomain.txt
g ! 2m0: ~ webcopilot -d example.com -o example -t 333 -x excludeDomain.txt -b eeuyhzfnsezrraragtd70ex5oc2hsw.oast.fun -f 명령을 사용하여 하위 도메인이 포함된 파일을 전달할 수 있습니다(이 건너뛰기 활성 + 수동 하위 도메인 열거 사용).
g ! 2m0: ~ webcopilot -d example.com -o example -f /home/ubuntu/subdomains.txt -a기본 옵션은 다음과 같습니다.
g ! 2m0: ~ webcopilot -d http://testphp.vulnweb.com/ -a -b eeuyhzfpwgnsezrraragtd70ex5oc2hsw.oast.fun ──────▄▀▄─────▄▀▄
─────▄█░░▀▀▀▀▀░░█▄
─▄▄──█░░░░░░░░░░░█──▄▄
█▄▄█─█░░▀░░┬░░▀░░█─█▄▄█
██╗░░░░░░░██╗███████╗██████╗░░█████╗░░█████╗░██████╗░██╗██╗░░░░░░█████╗░████████╗
░██║░░██╗░░██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║██║░░░░░██╔══██╗╚══██╔══╝
░╚██╗████╗██╔╝█████╗░░██████╦╝██║░░╚═╝██║░░██║██████╔╝██║██║░░░░░██║░░██║░░░██║░░░
░░████╔═████║░██╔══╝░░██╔══██╗██║░░██╗██║░░██║██╔═══╝░██║██║░░░░░██║░░██║░░░██║░░░
░░╚██╔╝░╚██╔╝░███████╗██████╦╝╚█████╔╝╚█████╔╝██║░░░░░██║███████╗╚█████╔╝░░░██║░░░
░░░╚═╝░░░╚═╝░░╚══════╝╚═════╝░░╚════╝░░╚════╝░╚═╝░░░░░╚═╝╚══════╝░╚════╝░░░░╚═╝░░░
[ ● ] Version: 2.0 .0
[ ● ] @ h4r5h1t | G ! 2 m0
[ ] Warning: Use with caution . You are responsible for your own actions .
[ ] Developers assume no liability and are not responsible for any misuse or damage cause by this tool .
Target : http: //testphp.vulnweb.com/
Output: / home / ubuntu / github / webcopilot / webcopilot - 1714304809
Threads: 100
Server: eeuyhzfpwgnsezdyeragtd70ex5oc2hsw . oast . fun
Exclude: False
Mode: Running all Enumeration
Time : 28 - 04 - 2024 17 : 16 : 49
[ ! ] Please wait while scanning . . .
[ ● ] Passive Subdomain Scanning is in progress :
[ ● ] Subdomain Scanned - [ assetfinder✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ SUBLIST3R_V2 .0 ✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ subfinder✔ ] Subdomain Found : 1
[ ● ] Subdomain Scanned - [ amass✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ findomain✔ ] Subdomain Found : 1
[ ● ] Subdomain Scanned - [ crt . sh✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ hackertarget✔ ] Subdomain Found : 1
[ ● ] Subdomain Scanned - [ riddler✔ ] Subdomain Found : 0
[ ● ] Subdomain Scanned - [ certspotter✔ ] Subdomain Found : 0
[ ● ] Active Subdomain Scanning is in progress :
[ ! ] Please be patient . This may take a while ...
[ ● ] Active Subdomain Scanned - [ gobuster✔ ] Subdomain Found : 0
[ ● ] Active Subdomain Scanned - [ amass✔ ] Subdomain Found : 0
[ ● ] Subdomain Filtering : Filtering Alive subdomains
[ ● ] Subdomain Filtering - Filtering alive subdomains is completed . Check : / subdomains / alivesub . txt
[ ● ] Subdomain Scanning : Getting titles of valid subdomains
[ ● ] Visual inspection of Subdomains is completed . Check : / subdomains / aquatone /
[ ● ] Subdomain Enumeration Completed . Total : 1 | Alive : 1
[ ● ] Endpoints Scanning Completed . Total : 0
[ ● ] Vulnerabilities Scanning is in progress : Getting all vulnerabilities of
[ ● ] Vulnerabilities Scanning is in progress :
[ ● ] Vulnerabilities Scanned - [ XSS✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ SQLi✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ LFI✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ CRLF✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ SSRF✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ Open redirect✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ Subdomain Takeover✔ ] Found : 0
[ ● ] Vulnerabilities Scanned - [ Nuclie✔ ] Found : 0
[ ● ] Vulnerabilities Scanning Completed . Check : / vulnerabilities /
▒█▀▀█ █▀▀ █▀▀ █░░█ █░░ ▀▀█▀▀
▒█▄▄▀ █▀▀ ▀▀█ █░░█ █░░ ░░█░░
▒█░▒█ ▀▀▀ ▀▀▀ ░▀▀▀ ▀▀▀ ░░▀░░
[ + ] Subdomains of http : //testphp.vulnweb.com/
[ + ] Subdomains Found : 1
[ + ] Subdomains Alive : 1
[ + ] Endpoints : 0
[ + ] XSS : 0
[ + ] SQLi : 0
[ + ] Open Redirect : 0
[ + ] SSRF : 0
[ + ] CRLF : 0
[ + ] LFI : 0
[ + ] Subdomain Takeover : 0
[ + ] Nuclei : 0WebCopilot은 ROX4R의 Garud & Pinaak에서 영감을 받았습니다.
@aboul3la @tomnomnom @lc @hahwul @projectdiscovery @maurosoria @shelld3v @devanshbatham @michenriksen @defparam @projectdiscovery @bp0lr @ameenmaali @sqlmapproject @dwisiswant0 @OWASP @OJ @Findomain @danielmiessler @1ndianl33t @ROX4R @xnl-h4ck3r @hxlxmjxbbxs @s0md3v
| 경고: 개발자는 이 도구로 인해 발생하는 오용이나 손상에 대해 책임을 지지 않으며 책임을 지지 않습니다. 그러므로 자신의 행동에 대한 책임은 본인에게 있으므로 주의하시기 바랍니다. |
