Garud - An Automation Tool That Scans Sub-Domains, Sub-Domain Takeover And Then Filters Out XSS, SSTI, SSRF And More Injection Point Parameters
2020-11-16 20:30:00 Author: www.blogger.com(查看原文) 阅读量:139 收藏

tag:blogger.com,1999:blog-8317222231133660547.post-15369254715458756262020-11-16T08:30:00.017-03:002020-11-16T08:30:01.733-03:00Garud - An Automation Tool That Scans Sub-Domains, Sub-Domain Takeover And Then Filters Out XSS, SSTI, SSRF And More Injection Point Parameters<div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-wKBpPH8MsMg/X7H1dmkHByI/AAAAAAAAUXI/KqSdwXPydfciODlnHodwI79xtKjvDAJ-QCNcBGAsYHQ/s1640/Garud_1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="664" data-original-width="1640" height="260" src="https://1.bp.blogspot.com/-wKBpPH8MsMg/X7H1dmkHByI/AAAAAAAAUXI/KqSdwXPydfciODlnHodwI79xtKjvDAJ-QCNcBGAsYHQ/w640-h260/Garud_1.png" width="640" /></a></div><p><br /></p> <p>An <a href="https://www.kitploit.com/search/label/Automation" target="_blank" title="automation">automation</a> tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more <a href="https://www.kitploit.com/search/label/Injection" target="_blank" title="injection">injection</a> point parameters.<br /></p> <span><a name='more'></a></span><p><br /></p><div class="separator" style="clear: both; text-align: center;"><a href="https://1.bp.blogspot.com/-fVMr1Ku8MW8/X7H1lqSCffI/AAAAAAAAUXM/2V67cq8GELovkQuBQuMNizD5F24BqyKzACNcBGAsYHQ/s800/Garud_2.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="571" data-original-width="800" height="456" src="https://1.bp.blogspot.com/-fVMr1Ku8MW8/X7H1lqSCffI/AAAAAAAAUXM/2V67cq8GELovkQuBQuMNizD5F24BqyKzACNcBGAsYHQ/w640-h456/Garud_2.gif" width="640" /></a></div><p><br /></p> <ul> <li> <strong>Requirements:</strong> Go Language, Python 2.7 or Python 3. </li> <li> <strong>System requirements:</strong> Recommended to run on vps with 1VCPU and 2GB ram. </li> <li> <strong>Tools used - You must need to install these tools to use this script</strong><br /> <ul> <li><a href="https://github.com/projectdiscovery/subfinder" rel="nofollow" target="_blank" title="SubFinder">SubFinder</a></li> <li><a href="https://github.com/aboul3la/Sublist3r" rel="nofollow" target="_blank" title="Sublist3r">Sublist3r</a></li> <li><a href="https://github.com/1ndianl33t/Gf-Patterns" rel="nofollow" target="_blank" title="GF Patterns">GF Patterns</a></li> <li><a href="https://github.com/lc/gau" rel="nofollow" target="_blank" title="Gau">Gau</a></li> <li><a href="https://github.com/LukaSikic/subzy" rel="nofollow" target="_blank" title="Subzy">Subzy</a></li> <li><a href="https://github.com/haccer/subjack" rel="nofollow" target="_blank" title="Subjack">Subjack</a>: save <a href="https://github.com/haccer/subjack/blob/master/fingerprints.json" rel="nofollow" target="_blank" title="fingerprints.json">fingerprints.json</a> file into ~/tools/ directory.</li> <li><a href="https://github.com/tomnomnom/assetfinder" rel="nofollow" target="_blank" title="Assetfinder">Assetfinder</a></li> <li><a href="https://github.com/projectdiscovery/httpx" rel="nofollow" target="_blank" title="HTTPX">HTTPX</a></li> <li><a href="https://github.com/tomnomnom/waybackurls" rel="nofollow" target="_blank" title="Waybackurls">Waybackurls</a></li> </ul> </li> <li> <strong>Installation</strong> </li> </ul> <div><pre><code>git clone https://github.com/R0X4R/Garud.git &amp;&amp; cd Garud/ &amp;&amp; chmod +x garud &amp;&amp; mv garud /usr/local/bin/</code></pre></div> <ul> <li><strong>Usage</strong></li> </ul> <div><pre><code>garud -d target.com -f filename</code></pre></div> <br /><span style="font-size: large;"><b>About Garud</b></span><br /> <p>I made this tool to automate my recon and save my time. It really give me headache always type such command and then wait to complete one command and I type other command. So I collected some of the tools which is widely used in the <a href="https://www.kitploit.com/search/label/Bugbounty" target="_blank" title="bugbounty">bugbounty</a> field. In this script I used Assetfinder, get-titles, httprobe, subjack, subzy, sublister, gau and gf patterns.<br /> The script first enumerates all the <a href="https://www.kitploit.com/search/label/Subdomains" target="_blank" title="subdomains">subdomains</a> of the give target domain using assetfinder and sublister then filters all live domains from the whole subdomain list then it extarct titles of the subdomains using get-title then it scans for <a href="https://www.kitploit.com/search/label/Subdomain%20Takeover" target="_blank" title="subdomain takeover">subdomain takeover</a> using subjack and subzy. Then it uses gau to extract paramters of the given subdomains then it use gf patterns to filters xss, ssti, ssrf, sqli params from that given subdomains. Then it'll save all the output in a text file like target-xss.txt.&nbsp;</p> <br /><b>Thanks to the authors of the tools used in this script.</b><br /> <p><a href="https://github.com/aboul3la" rel="nofollow" target="_blank" title="@aboul3la">@aboul3la</a> <a href="https://github.com/tomnomnom" rel="nofollow" target="_blank" title="@tomnomnom">@tomnomnom</a> <a href="https://github.com/lc" rel="nofollow" target="_blank" title="@lc">@lc</a> <a href="https://github.com/LukaSikic" rel="nofollow" target="_blank" title="@LukaSikic">@LukaSikic</a> <a href="https://github.com/haccer" rel="nofollow" target="_blank" title="@haccer">@haccer</a></p> <p><strong>Warning:</strong> This code was originally created for personal use, it generates a substantial amount of traffic, please use with caution.</p> <br /><br /><div style="text-align: center;"><b><span style="font-size: x-large;"><a class="kiploit-download" href="https://github.com/R0X4R/Garud" rel="nofollow" target="_blank" title="Download Garud">Download Garud</a></span></b></div>Zion3R[email protected]

文章来源: http://www.blogger.com/feeds/8317222231133660547/posts/default/1536925471545875626
如有侵权请联系:admin#unsafe.sh