11#! /usr/bin/env bash
22# 2018-2019 by Shiva @ CPH:SEC
3+ <<< <<< <
34
45# WAES requires vulners.nse : https://github.com/vulnersCom/nmap-vulners
56# WAES requires supergobuster : https://gist.github.com/lokori/17a604cad15e30ddae932050bbcc42f9
67# WAEs requires SecLists : https://github.com/danielmiessler/SecLists
78
9+ =======
10+ >>>>>>> 56b17398b9ba8589c6a8aa43aee0262070e1629f
811
912# Script begins
1013# ===============================================================================
1114
15+ # set -x # Starts debugging
1216
1317# vars
14- VERSION=" 0.0.3b "
15- VULNERSDIR=" nmap-vulners " # Where to find vulners.nse
18+ VERSION=" 0.0.36 alpha "
19+ VULNERSDIR=" vulscan " # Where to find vulscan
1620REPORTDIR=" report" # /report directory
17- TOOLS=( " nmap" " nikto" " uniscan" " gobuster" " dirb" " whatweb"
18- # SECLISTDIR="SecLists"
21+ TOOLS=( " nmap" " nikto" " uniscan" " gobuster" " dirb" " whatweb" " wafw00f"
22+ HTTPNSE=( " http-date,http-title,http-server-header,http-headers,http-enum,http-devframework,http-dombased-xss,http-stored-xss,http-xssed,http-cookie-flags,http-errors,http-grep,http-traceroute"
23+ PORT=80 # Setting std port
24+ COUNT=-1 # For tools loop
1925
2026# banner / help message
2127echo " "
2228echo -e " \e[00;32m#############################################################\e[00m"
2329echo " "
2430echo -e " Web Auto Enum & Scanner $VERSION "
2531echo " "
26- echo -e " Auto enums website(s) and dumps files as result"
32+ echo -e " Auto enums HTTP port and dumps files as result"
2733echo " "
2834echo -e " \e[00;32m#############################################################\e[00m"
2935echo " "
@@ -34,15 +40,28 @@ echo "Usage: ${0##*/} -u {url}"
3440echo " ${0##*/ } -h"
3541echo " "
3642echo " -h shows this help"
37- echo " -u url to test without http or https e.g. testsite.com"
43+ echo " -u IP to test eg. 10.10.10.123"
44+ echo " -p port number (default=80)"
45+ echo " "
46+ echo " Example: ./waes.sh -u 10.10.10.130 -p 8080"
3847echo " "
3948}
4049
50+ if [[ ` id -u` -ne 0 ]] ; then echo -e " \e[01;31m[!]\e[00m This program must be run as root. Run again with 'sudo'" ; exit 1 ; fi
51+
4152# Checks for input parameters
4253: ${1?" No arguments supplied - run waes -h for help or cat README.md"
4354
55+ # Showing parameters - for debugging only
56+ # echo "Positional Parameters"
57+ # echo '$0 = ' $0
58+ # echo '$1 = ' $1
59+ # echo '$2 = ' $2
60+ # echo '$3 = ' $3
61+ # echo '$4 = ' $4
4462
45- if [ $1 == " -h"
63+ # Parameters check
64+ if [[ $1 == " -h"
4665 then
4766 usage
4867 exit 1
@@ -54,47 +73,93 @@ if [[ "$1" != "-u" && "$1" != "-h" ]]; then
5473 exit 1
5574fi
5675
57- # Check for nmap
58- which nmap> /dev/null
59- if [ $? -eq 0 ]
60- then
61- echo " "
62- else
63- echo " "
64- echo -e " \e[01;31m[!]\e[00m Unable to find the required nmap program, install and try again"
65- exit 1
76+ if [[ " $3 " = " -p" && " $4 " != " " ; then
77+ PORT=" $4 "
78+ # echo "Port is set to: " $PORT
6679fi
6780
68- # Check for nikto
69- which nikto > /dev/null
70- if [ $? -eq 0 ]
71- then
72- echo " "
73- else
74- echo " "
75- echo -e " \e[01;31m[!]\e[00m Unable to find the required nikto program, install and try again "
76- exit 1
77- fi
81+ # Tools installed check
82+ while [[ " x ${TOOLS[COUNT]} " != " x " ]]
83+ do
84+ COUNT= $(( $COUNT + 1 ))
85+ if ! hash ${TOOLS[COUNT]} /dev/null 2>&1
86+ then
87+ echo -e " \e[01;31m[!]\e[00m ${TOOLS[COUNT]} was not found in PATH "
88+ echo " Run sudo ./install.sh to install tools "
89+ fi
90+ done
7891
79- # Check for uniscan
80- which uniscan> /dev/null
81- if [ $? -eq 0 ]
82- then
83- echo " "
84- else
85- echo " "
86- echo -e " \e[01;31m[!]\e[00m Unable to find the required uniscan program, install and try again"
87- exit 1
88- fi
92+ echo " "
93+ echo -e " Target: $2 port: $PORT "
8994
90- # Check if root
91- if [[ $EUID -ne 0 ]]; then
92- echo " "
93- echo -e " \e[01;31m[!]\e[00m This program must be run as root. Run again with 'sudo'"
94- echo " "
95- exit 1
96- fi
95+ # Todo: Implement progressbar (bartest.sh)
96+
97+ passive () {
98+
99+ echo " Starting PASSIVE scans..."
100+ # Whatweb
101+ echo -e " \e[00;32m [+] Looking up " $2 " with whatweb - only works for online targets" " \e[00m"
102+ whatweb -a 3 $2 " :" $PORT | tee ${REPORTDIR} /$2 _whatweb.txt
103+
104+ # OSIRA - For subdomain enum
105+ echo -e " \e[00;32m [+] OSIRA against:" $2 " - looking for subdomains \e[00m"
106+ OSIRA/osira.sh -u $2 " :" $PORT | tee ${REPORTDIR} /$2 _osira.txt
107+ }
108+
109+ fastscan () {
110+
111+ echo " Step 1: Starting fast scan... "
112+ # wafw00f
113+ echo -e " \e[00;32m [+] Detecting firewall " $2 " :" $PORT " with wafw00f" " \e[00m"
114+ wafw00f -a -v $2 " :" $PORT | tee $REPORTDIR /$2 _wafw00f.txt
115+ # nmap http-enum
116+ echo -e " \e[00;32m [+] nmap with HTTP-ENUM script against $2 " " \e[00m"
117+ nmap -sSV -Pn -T4 -p $PORT --script http-enum $2 -oA ${REPORTDIR} /$2 _nmap_http-enum
118+ }
119+
120+ scan () {
121+
122+ echo " Step 2: Starting more in-depth scan... "
123+ # nmap
124+ echo -e " \e[00;32m [+] nmap with various HTTP scripts against $2 " " \e[00m"
125+ nmap -sSV -Pn -T4 -p $PORT --script $HTTPNSE $2 -oA ${REPORTDIR} /$2 _nmap_http-va
126+ echo -e " \e[00;32m [+] nmap with vulscan on $2 with min CVSS 5.0" " \e[00m"
127+ nmap -sSV -Pn -O -T4 --version-all -p $PORT --script ${VULNERSDIR} /vulscan.nse $2 --script-args mincvss=5-0 -oA ${REPORTDIR} /$2 _nmap_vulners
128+
129+ # nikto
130+ echo -e " \e[00;32m [+] nikto on $2 " " \e[00m"
131+ nikto -h $2 -port $PORT -C all -ask no -evasion A | tee $REPORTDIR /$2 _nikto.txt
132+
133+ # uniscan
134+ echo -e " \e[00;32m [+] uniscan of $2 " " \e[00m"
135+ uniscan -u $2 " :" $PORT -qweds | tee $REPORTDIR /$2 _uniscan.txt
136+ }
137+
138+ fuzzing () {
139+
140+ echo " Step 3: Starting fuzzing... "
141+ # xsser
142+ # echo -e "\e[00;32m [+] xsser on $2" "\e[00m"
143+ # Todo: Implement Xsser (requires url not ip)
144+
145+ # Supergobuster: gobuster + dirb
146+ echo -e " \e[00;32m [+] super go busting $2 " " \e[00m"
147+ ./supergobuster.sh " http://" $2 " :" $PORT | tee $REPORTDIR /$2 _supergobust.txt
148+ }
149+
150+ end () {
151+ echo -e " \e[00;32m [+] WAES is done. Find results in:" ${REPORTDIR} " \e[00m"
152+ }
153+
154+ # passive $1 $2 $3 $4 # Uncomment to run, work online for online targets Todo: Add in next version
155+ fastscan $1 $2 $3 $4
156+ scan $1 $2 $3 $4
157+ fuzzing $1 $2 $3 $4
158+ end $1 $2 $3 $4
159+
160+ # Todo: Add from rapidscan / golismero and others
97161
162+ <<< <<< <
98163#
99164echo -e " Target: $2 "
100165
@@ -130,3 +195,6 @@ echo -e "\e[00;32m [+] super go busting $2" "\e[00m"
130195./supergobuster.sh $2 | tee $REPORTDIR /$2 _supergobust.txt
131196
132197echo -e " \e[00;32m [+] WAES is done. Find results in:" ${REPORTDIR} " \e[00m"
198+ =======
199+ # set +x # Ends debugging
200+ >>>>>>> 56b17398b9ba8589c6a8aa43aee0262070e1629f
0 commit comments