Coleta Automatizada de Informações

CyberPunk » Information Gathering

---

     A reconnaissance tool made for the OSCP labs to automate information gathering and service enumeration whilst creating a directory structure to store results, findings and exploits used for each host, recommended commands to execute and directory structures for storing loot and flags.

Usage

This tool can be used and copied for personal use freely however attribution and credit should be offered to Mike Czumak who originally started the process of automating this work.

Argument	Description
-h, –help	Display help message and exit
-t TARGET_HOSTS	Set either a target range of addresses or a single host to target. May also be a file containing hosts.
-o OUTPUT_DIRECTORY	Set the target directory where results should be written.
-w WORDLIST	Optionally specify your own wordlist to use for pre-compiled commands, or executed attacks.
–dns DNS_SERVER	Optionally specify a DNS server to use with a service scan.
–pingsweep	Write a new target.txt file in the OUTPUT_DIRECTORY by performing a ping sweep and discovering live hosts.
–dnssweep	Find DNS servers from the list of target(s).
–snmp	Find hosts responding to SNMP requests from the list of target(s).
–services	Perform a service scan over the target(s) and write recommendations for further commands to execute.
–snmpwalk	SNMP walk target hosts and save results.
–hostnames	Attempt to discover target hostnames and write to hostnames.txt.
–quiet	Supress banner and headers and limit feedback to grepable results.
–execute	Execute shell commands from recommendations as they are discovered. Likely to lead to very long execution times depending on the wordlist being used and discovered vectors.
–simple_exec	Execute non-brute forcing shell comamnds only commands as they are discovered. Likely to lead to very long execution times depending on the wordlist being used and discovered vectors.
–quick	Move to the next target after performing a quick scan and writing first-round recommendations.

Usage Examples

---

Note that these are some examples to give you insight into potential use cases for this tool. Command lines can be added or removed based on what you wish to acomplish with your scan.

Scan a single host, create a file structure and discover services

python ./reconnoitre.py -t 192.168.1.5 -o /root/Documents/labs/ --services

Discover live hosts and hostnames within a range

python ./reconnoitre.py -t 192.168.1.1-252 -o /root/Documents/testing/ --pingsweep --hostnames

Discover live hosts within a range and then do a quick probe for services

python ./reconnoitre.py -t 192.168.1.1-252 -o /root/Documents/testing/ --pingsweep --services --quick

This will scan all services within a target range to create a file structure of live hosts as well as write recommendations for other commands to be executed based on the services discovered on these machines. Removing –quick will do a further probe but will greatly lengthen execution times.

Discover live hosts within a range and then do probe all ports (UDP and TCP) for services

python ./reconnoitre.py -t 192.168.1.1-252 -o /root/Documents/testing/ --pingsweep --services

Requirements

     This bare requirement for host and service scanning for this tool is to have both nbtscan and nmap installed. If you are not using host scanning and only wish to perform a ping sweep and service scan you can get away with only installing nmap. The outputted findings.txt will often recommend additional tools which you may not have available in your distribution if not using Kali Linux. All requirements and recommendations are native to Kali Linux which is the recommended (although not required) distribution for using this tool.

In addition to these requirements outputs will often refer to Wordlists that you may need to find. If you are undertaking OSCP these can be found in the “List of Recommended Tools” thread by g0tmilk. If not then you can find the majority of these online or already within a Kali Linux installation.