CHOMTE.SH

Be sure to :star: this repo so you can keep up to date on any daily progress!

CHOMTE.SH is a versatile framework designed for automating reconnaissance tasks in penetration testing. It's useful for bug bounty hunters and penetration testers in both internal and external network engagements. Its key features include subdomain gathering, DNS subdomain brute-forcing, quick port scanning, HTTP probing, service enumeration, and generating reports in various formats. Additionally, it performs content discovery, identifies common misconfigurations and vulnerabilities, conducts deep internet reconnaissance, provides command transparency, and specializes in JavaScript reconnaissance. Users can customize tool arguments by modifying the flags.conf file.

Major Features

Here are some of the key features that make CHOMTE.SH a must-have for security professionals:

1. Subdomain Discovery: Easily gather subdomains with the help of the robust subfinder tool.
2. DNS Subdomain Bruteforcing: Strengthen your DNS security by performing subdomain bruteforcing with the dmut tool.
3. Quick Port Scanning: Quickly identify potential vulnerabilities by performing port scans using Naabu.
4. HTTP Probing: Generate detailed reports, including techdetect and webanalyze, using projectdiscovery HTTPX.
5. Service Enumeration: Discover open ports and services using Nmap, focusing only on what matters.
6. Reporting: Create comprehensive reports in XML, NMAP, CSV, and HTML formats, allowing you to present your findings effectively.
7. Content Discovery: Identify sensitive files exposed in web applications and rectify potential security flaws.
8. Vulnerability Scanning: Uncover common misconfigurations and vulnerabilities in your infrastructure and web applications.
9. Deep Reconnaissance: Leverage Shodan and Certificate Transparency for thorough internet-wide reconnaissance.
10. Command Transparency: Gain full visibility into executed commands, their locations, and file outputs.
11. URL Extraction and Validation: Collect all URLs, extract JavaScript files, and validate them, including those with unique parameters.
12. Nuclei-based Scanning: Run Nuclei scans based on technologies found in subdomains and perform parameter fuzzing on URLs.
13. JavaScript Recon: Uncover hardcoded credentials, sensitive keys, and passwords in your applications.
14. Customization: Tailor the tool's behavior to your needs by modifying the flags.conf file.

CHOMTE.SH is a game-changer for cybersecurity professionals, offering a comprehensive toolkit to secure your digital assets and strengthen your web application defenses. Stay ahead of threats, protect your online presence, and make CHOMTE.SH a part of your security arsenal.

Installation

To install CHOMTE.SH, follow these steps:

1. Clone the repository: git clone https://github.com/mr-rizwan-syed/chomtesh
2. Change the directory: cd chomtesh
3. Switch to root user sudo su
4. Make the script executable: chmod +x *.sh
5. Run the installation script: ./install.sh
6. Run Chomte.sh: ./chomte.sh

Usage

To use CHOMTE.SH, run the script with the following flags:

└─# ./chomte.sh


 ██████╗██╗  ██╗ ██████╗ ███╗   ███╗████████╗███████╗   ███████╗██╗  ██╗
██╔════╝██║  ██║██╔═══██╗████╗ ████║╚══██╔══╝██╔════╝   ██╔════╝██║  ██║
██║     ███████║██║   ██║██╔████╔██║   ██║   █████╗     ███████╗███████║
██║     ██╔══██║██║   ██║██║╚██╔╝██║   ██║   ██╔══╝     ╚════██║██╔══██║
╚██████╗██║  ██║╚██████╔╝██║ ╚═╝ ██║   ██║   ███████╗██╗███████║██║  ██║
 ╚═════╝╚═╝  ╚═╝ ╚═════╝ ╚═╝     ╚═╝   ╚═╝   ╚══════╝╚═╝╚══════╝╚═╝  ╚═╝

 U S A G E
Usage: ./chomte.sh -p <ProjectName> -d <domain.com> [option]
Usage: ./chomte.sh -p <ProjectName> -i <127.0.0.1> [option]
Usage: ./chomte.sh -p projectname -d example.com -brt -jsd -sto -n -cd -e -js -ex
Usage: ./chomte.sh -p projectname -d Domains-list.txt
Usage: ./chomte.sh -p projectname -i 127.0.0.1
Usage: ./chomte.sh -p projectname -i IPs-list.txt -n -cd -e -js -ex

Mandatory Flags:
    -p   | --project <string>       : Specify Project Name here
    -d   | --domain <string>        : Specify Root Domain here / Domain List here
      OR
    -i   | --ip <string>            : Specify IP / IPlist here - Starts with Naabu
    -c   | --cidr | --asn <string>  : CIDR / ASN - Starts with Nmap Host Discovery
      OR
    -hpl | --hostportlist <filename>: HTTP Probing on Host:Port List

╔════════════════════════════════════════════════════════════════════════════════╗
        Optional Flags - Only applicable with domain -d flag
╚════════════════════════════════════════════════════════════════════════════════╝


    -sd | --singledomain            : Single Domain for In-Scope Engagement
    -pp   | --portprobe             : Probe HTTP web services in ports other than 80 & 443
    -a   | --all                    : Run all required scans
    -rr   | --rerun                 : ReRun the scan again
    -brt | --dnsbrute               : DNS Recon Bruteforce
        -ax | --alterx              : Subdomain Bruteforcing using DNSx on Alterx Generated Domains
    -sto | --takeover               : Subdomain Takeover Scan


╔════════════════════════════════════════════════════════════════════════════════╗
        Global Flags - Applicable with both -d / -i
╚════════════════════════════════════════════════════════════════════════════════╝
    -s   | --shodan                    : Shodan Deep Recon - API Key Required
    -n   | --nmap                      : Nmap Scan against open ports
    -e   | --enum                      : Active Recon
       -cd  | --content                : Content Discovery Scan
       -cd  | --content subdomains.txt : Content Discovery Scan
       -ru  | --reconurl               : URL Recon; applicable with enum -e flag
       -ex  | --enumxnl                : XNL JS Recon; applicable with enum -e flag
       -nf  | --nucleifuzz             : Nuclei Fuzz; applicable with enum -e flag
    -h   | --help                      : Show this help

Mandatory Flags

• -p or --project: Specify the project name here.
• -d or --domain: Specify the root domain here or a domain list.
• -i or --ip: Specify the IP/CIDR/IP list here.

Optional Flags

-n or --nmap : Nmap scan against open ports.
-brt or --dnsbrute : DNS Recon Bruteforce.
-hpl or --hostportlist : HTTP Probing on Host:Port List
-cd or --content : Content Discovery - Path is optional
-e or --enum : Active Enum based on technologies
-h or --help : Show help.