a7vinx/swarmUna herramienta de pruebas de penetración modular y distribuida.
v0.6.0
Inglés | 中文.
Swarm es una herramienta modular de pruebas de penetración distribuida de código abierto que utiliza una cola de tareas distribuida para implementar la comunicación en un sistema modo maestro-esclavo y usa MongoDB para el almacenamiento de datos. Se compone de un marco distribuido y módulos funcionales. El módulo funcional puede ser una implementación completamente nueva de algunas funciones de penetración o puede ser un simple envoltorio de una herramienta existente para implementar funcionalidad distribuida. Debido a la arquitectura modular, es fácil personalizar y ampliar nuevas funciones bajo el marco distribuido.
Ahora, en esta versión 0.6.0, tiene cinco módulos:
Si deseas escribir tu propio módulo, puedes leer esto.
Se puede descargar el Zipball aquí. También puedes usar git para obtener swarm:
git clone [email protected]:Arvin-X/swarm.git
luego usa setup.py para instalar swarm:
python setup.py install
Swarm funciona con Python 2.6.x o 2.7.x y necesita soporte de MongoDB en el host maestro.
Si aún no tienes MongoDB, puedes usar apt-get para instalarlo:
apt-get install mongodb
Ejecuta swarm en el host maestro para distribuir tareas y ejecuta swarm-s con la opción '-p' en el host esclavo para completar las subtareas del maestro.
swarm-s -p 9090
También puedes establecer un listener en el puerto destino del host esclavo para recibir comandos y activar swarm-s especificando la opción '--waken' al ejecutar swarm. De lo contrario, debes dejar '--waken' nulo. Para crear un listener, puedes usar nc o socat así:
nc -e /bin/sh -l 9191
Y usa el comando de activación como:
swarm-s ARGS
Debes dejar "ARGS" en tu comando y asegurarte de que serán los argumentos de CLI pasados a swarm para que swarm los reemplace con algunos argumentos necesarios como '-p'.
Uso básico de swarm:
usage: swarm [-h] -m MODULE [-v] [-c] [-o PATH] [-t [TARGET [TARGET ...]]]
[-T PATH] [-s [SWARM [SWARM ...]]] [-S PATH] [--waken CMD]
[--timeout TIME] [--m-addr ADDR] [--m-port PORT] [--s-port PORT]
[--authkey KEY] [--db-addr ADDR] [--db-port PORT] [--process NUM]
[--thread NUM] [--taskg NUM] [--dom-compbrute] [--dom-dict PATH]
[--dom-maxlevel NUM] [--dom-charset SET] [--dom-levellen LEN]
[--dom-timeout TIME] [--dir-http-port PORT]
[--dir-https-port PORT] [--dir-compbrute] [--dir-charset SET]
[--dir-len LEN] [--dir-dict PATH] [--dir-maxdepth NUM]
[--dir-timeout TIME] [--dir-not-exist FLAG] [--dir-quick-scan]
[--nmap-ports PORTS] [--nmap-top-ports NUM] [--nmap-ops ...]
[--int-target [URLS [URLS ...]]] [--int-method METHOD]
[--int-headers JSON] [--int-cookies COOKIES] [--int-body BODY]
[--int-payload PAYLOAD] [--int-flag FLAGS] [--int-timeout TIME]
[--map-seed SEED] [--map-http-port PORT] [--map-https-port PORT]
[--map-cookies COOKIES] [--map-interval TIME]
[--map-timeout TIME]
optional arguments:
-h, --help show this help message and exit
-m MODULE Use module name in ./modules/ to enable it
Output:
These option can be used to control output
-v Output more verbose
-c Disable colorful log output
-o PATH Record log in target file
Target:
At least one of these options has to be provided to define target unless
there is another special option for defining target in the module
-t [TARGET [TARGET ...]]
Separated by blank (eg: github.com 127.0.0.0/24
192.168.1.5)
-T PATH File that contains target list, one target per line
Swarm:
Use these options to customize swarm connection. At least one of slave
host has to be provided.
-s [SWARM [SWARM ...]]
Address of slave hosts with port if you need waken
them (eg: 192.168.1.2:9090 192.18.1.3:9191). No port
if swarm-s on slave host has already run
-S PATH File that contains slave list, one host per line
--waken CMD Command to waken up slave hosts, null if swarm-s on
slave host has already run
--timeout TIME Seconds to wait before request to swarm getting
response
--m-addr ADDR Master address which is reachable by all slave hosts
--m-port PORT Listen port on master host to distribute task
--s-port PORT Listen port on slave host to receive command from
master
--authkey KEY Auth key between master and slave hosts
Database:
These option can be used to access MongoDB server
--db-addr ADDR Address of MongoDB server
--db-port PORT Listening port of MongoDB server
Common:
These option can be used to customize common configuration of slave host
--process NUM Max number of concurrent process on slave host
--thread NUM Max number of concurrent threads on slave host
--taskg NUM Granularity of subtasks from 1 to 3
Domain Scan:
Thes option can be used to customize swarm action of subdomain name scan
--dom-compbrute Use complete brute force without dictionary on target
--dom-dict PATH Path to dictionary used for subdomain name scan
--dom-maxlevel NUM Max level of subdomain name to scan
--dom-charset SET Charset used for complete brute foce
--dom-levellen LEN Length interval of subdomain name each level
--dom-timeout TIME Timeout option for subdomain name scan
Directory Scan:
These option can be used to customize swarm action of directory scan
--dir-http-port PORT Separated by comma if you need multiple ports
--dir-https-port PORT
Separated by comma if you need multiple ports
--dir-compbrute Use complete brute force without dictionary on target
--dir-charset SET Charset used for complete brute foce
--dir-len LEN Length interval of directory name or file name
--dir-dict PATH Path to dictionary used for directory scan
--dir-maxdepth NUM Max depth in directory and file scan
--dir-timeout TIME Timeout option for directory scan
--dir-not-exist FLAG Separated by double comma if you need multiple flags
--dir-quick-scan Use HEAD method instead of GET in scan
Nmap Module:
These options can be used customize nmap action on slave hosts
--nmap-ports PORTS Support format like '80,443,3306,1024-2048'
--nmap-top-ports NUM Scan <number> most common ports
--nmap-ops ... Nmap options list in nmap's man pages, this should
be the last in cli args
Intruder:
Use indicator symbol '@n@' where 'n' should be a number, like '@0@','@1@'
etc to specify attack point in option 'int_target' and 'int_body'. Use
'int_payload' option to specify payload used on these attack point to
complete this attack.