a7vinx/swarmUna herramienta de pruebas de penetración modular y distribuida.
v0.6.0
Inglés | 中文.
Swarm es una herramienta modular de pruebas de penetración distribuida de código abierto que utiliza una cola de tareas distribuida para implementar la comunicación en un sistema modo maestro-esclavo y usa MongoDB para el almacenamiento de datos. Se compone de un marco distribuido y módulos funcionales. El módulo funcional puede ser una implementación completamente nueva de algunas funciones de penetración o puede ser un simple envoltorio de una herramienta existente para implementar funcionalidad distribuida. Debido a la arquitectura modular, es fácil personalizar y ampliar nuevas funciones bajo el marco distribuido.
Ahora, en esta versión 0.6.0, tiene cinco módulos:
Si deseas escribir tu propio módulo, puedes leer esto.
Se puede descargar el Zipball aquí. También puedes usar git para obtener swarm:
git clone [email protected]:Arvin-X/swarm.git
luego usa setup.py para instalar swarm:
python setup.py install
Swarm funciona con Python 2.6.x o 2.7.x y necesita soporte de MongoDB en el host maestro.
Si aún no tienes MongoDB, puedes usar apt-get para instalarlo:
apt-get install mongodb
Ejecuta swarm en el host maestro para distribuir tareas y ejecuta swarm-s con la opción '-p' en el host esclavo para completar las subtareas del maestro.
swarm-s -p 9090
También puedes establecer un listener en el puerto destino del host esclavo para recibir comandos y activar swarm-s especificando la opción '--waken' al ejecutar swarm. De lo contrario, debes dejar '--waken' nulo. Para crear un listener, puedes usar nc o socat así:
nc -e /bin/sh -l 9191
Y usa el comando de activación como:
swarm-s ARGS
Debes dejar "ARGS" en tu comando y asegurarte de que serán los argumentos de CLI pasados a swarm para que swarm los reemplace con algunos argumentos necesarios como '-p'.
Uso básico de swarm:
usage: swarm [-h] -m MODULE [-v] [-c] [-o PATH] [-t [TARGET [TARGET ...]]]
[-T PATH] [-s [SWARM [SWARM ...]]] [-S PATH] [--waken CMD]
[--timeout TIME] [--m-addr ADDR] [--m-port PORT] [--s-port PORT]
[--authkey KEY] [--db-addr ADDR] [--db-port PORT] [--process NUM]
[--thread NUM] [--taskg NUM] [--dom-compbrute] [--dom-dict PATH]
[--dom-maxlevel NUM] [--dom-charset SET] [--dom-levellen LEN]
[--dom-timeout TIME] [--dir-http-port PORT]
[--dir-https-port PORT] [--dir-compbrute] [--dir-charset SET]
[--dir-len LEN] [--dir-dict PATH] [--dir-maxdepth NUM]
[--dir-timeout TIME] [--dir-not-exist FLAG] [--dir-quick-scan]
[--nmap-ports PORTS] [--nmap-top-ports NUM] [--nmap-ops ...]
[--int-target [URLS [URLS ...]]] [--int-method METHOD]
[--int-headers JSON] [--int-cookies COOKIES] [--int-body BODY]
[--int-payload PAYLOAD] [--int-flag FLAGS] [--int-timeout TIME]
[--map-seed SEED] [--map-http-port PORT] [--map-https-port PORT]
[--map-cookies COOKIES] [--map-interval TIME]
[--map-timeout TIME]
optional arguments:
-h, --help show this help message and exit
-m MODULE Use module name in ./modules/ to enable it
Output:
These option can be used to control output
-v Output more verbose
-c Disable colorful log output
-o PATH Record log in target file
Target:
At least one of these options has to be provided to define target unless
there is another special option for defining target in the module
-t [TARGET [TARGET ...]]
Separated by blank (eg: github.com 127.0.0.0/24
192.168.1.5)
-T PATH File that contains target list, one target per line
Swarm:
Use these options to customize swarm connection. At least one of slave
host has to be provided.
-s [SWARM [SWARM ...]]
Address of slave hosts with port if you need waken
them (eg: 192.168.1.2:9090 192.18.1.3:9191). No port
if swarm-s on slave host has already run
-S PATH File that contains slave list, one host per line
--waken CMD Command to waken up slave hosts, null if swarm-s on
slave host has already run
--timeout TIME Seconds to wait before request to swarm getting
response
--m-addr ADDR Master address which is reachable by all slave hosts
--m-port PORT Listen port on master host to distribute task
--s-port PORT Listen port on slave host to receive command from
master
--authkey KEY Auth key between master and slave hosts
Database:
These option can be used to access MongoDB server
--db-addr ADDR Address of MongoDB server
--db-port PORT Listening port of MongoDB server
Common:
These option can be used to customize common configuration of slave host
--process NUM Max number of concurrent process on slave host
--thread NUM Max number of concurrent threads on slave host
--taskg NUM Granularity of subtasks from 1 to 3
Domain Scan:
Thes option can be used to customize swarm action of subdomain name scan
--dom-compbrute Use complete brute force without dictionary on target
--dom-dict PATH Path to dictionary used for subdomain name scan
--dom-maxlevel NUM Max level of subdomain name to scan
--dom-charset SET Charset used for complete brute foce
--dom-levellen LEN Length interval of subdomain name each level
--dom-timeout TIME Timeout option for subdomain name scan
Directory Scan:
These option can be used to customize swarm action of directory scan
--dir-http-port PORT Separated by comma if you need multiple ports
--dir-https-port PORT
Separated by comma if you need multiple ports
--dir-compbrute Use complete brute force without dictionary on target
--dir-charset SET Charset used for complete brute foce
--dir-len LEN Length interval of directory name or file name
--dir-dict PATH Path to dictionary used for directory scan
--dir-maxdepth NUM Max depth in directory and file scan
--dir-timeout TIME Timeout option for directory scan
--dir-not-exist FLAG Separated by double comma if you need multiple flags
--dir-quick-scan Use HEAD method instead of GET in scan
Nmap Module:
These options can be used customize nmap action on slave hosts
--nmap-ports PORTS Support format like '80,443,3306,1024-2048'
--nmap-top-ports NUM Scan <number> most common ports
--nmap-ops ... Nmap options list in nmap's man pages, this should
be the last in cli args
Intruder:
Use indicator symbol '@n@' where 'n' should be a number, like '@0@','@1@'
etc to specify attack point in option 'int_target' and 'int_body'. Use
'int_payload' option to specify payload used on these attack point to
complete this attack.
--int-target [URLS [URLS ...]]
Use this option instead of '-t' or '-T' options to
specify targets,separated by comma
--int-method METHOD Http method used in this attack
--int-headers JSON A JSON format data.(eg: {"User-
Agent":"Mozilla/5.0","Origin":"XXX"})
--int-cookies COOKIES
Separated by comma. (eg: PHPSESSIONID:XX,token:XX)
--int-body BODY HTTP or HTTPS body. You can use indicator symbol in
this option
--int-payload PAYLOAD
The format should follow '@0@:PATH,@1@:CHARSET
:NUM-NUM'
--int-flag FLAGS Separated by double comma if you have multiple flags
--int-timeout TIME Timeout option for intruder module
Sitemap Crawler:
These options can be used to customize sitemap crawler, not support js
parse yet
--map-seed SEED Separated by comma if you have multiple seeds
--map-http-port PORT Separated by comma if you need multiple ports
--map-https-port PORT
Separated by comma if you need multiple ports
--map-cookies COOKIES
Separated by comma if you have multiple cookies
--map-interval TIME Interval time between two request
--map-timeout TIME Timeout option for sitemap crawler
Se recomienda usar un archivo de configuración para configurar swarm en lugar de usar argumentos de línea de comandos si tus requisitos son altos. Los archivos de configuración se encuentran en /etc/swarm/.
Swarm está licenciado bajo GPLv3.