m3n0sd0n4ld/goofuzzStrumento di fuzzing basato su Bash che sfrutta Google Dorking per l'enumerazione stealth di directory, file, sottodomini e parametri senza richieste dirette al server.
GooFuzz è uno script scritto in Bash Scripting che utilizza tecniche avanzate di ricerca su Google per ottenere informazioni sensibili in file o directory senza effettuare richieste al server web.
Vuoi conoscere le nuove funzionalità della versione 2.0 e come utilizzare correttamente lo strumento?
Dai un'occhiata al seguente articolo e sfrutta al massimo lo strumento.
cxId e apikey in un file. Entrambi sono gratuiti.GooFuzz-Project).API key.GooFuzz-Search) e fai clic su Crea.cxId.git clone https://github.com/m3n0sd0n4ld/GooFuzz.git cd GooFuzz sudo apt install jq chmod +x GooFuzz ./GooFuzz -h
# Docker version:```console
git clone https://github.com/m3n0sd0n4ld/GooFuzz.git
cd GooFuzz
docker build -t goofuzz .
docker run --rm -it goofuzz -h
./GooFuzz -h
*
Usage: -h Display this help message. -k Specify a FILE with CX_ID,API_KEY pairs, one per line. -w Specify a DICTIONARY, PATHS or FILES. -e Specify comma-separated extensions. -t Specify a DOMAIN or IP Address. -p Specify the number of PAGES (Default: 1). -x EXCLUDES targets (comma-separated or file). -d Delay in seconds between requests. -s Lists subdomains of the specified domain. -c Specify relevant content (comma-separated or file). -o Export the results to a file (results only). -r Specify an [protocol://]host[:port] proxy.
Examples: GooFuzz -t site.com -k keys_file.txt -e pdf,doc,bak GooFuzz -t site.com -k keys_file.txt -s -p 10 -d 5 -o GooFuzz-subdomains.txt GooFuzz -t site.com -k keys_file.txt -w config.php,admin,/images/ GooFuzz -t site.com -k keys_file.txt -w wordlist.txt GooFuzz -t site.com -k keys_file.txt -w login.html -x dev.site.com GooFuzz -t site.com -k keys_file.txt -w admin.html -x exclusion_list.txt GooFuzz -t site.com -k keys_file.txt -c P@ssw0rd! GooFuzz -t site.com -k keys_file.txt -e pdf -r http://proxy.example.com:8080
## Elenca i file per estensioni separate da virgole.```console
> ./GooFuzz -t nasa.gov -e pdf,doc,docx,txt,xls,zip -p 3 -k apikey.lst -o extensions.txt
*********************************************************
* GooFuzz v.2.0 - The Power of Google Dorks *
*********************************************************
Target: nasa.gov
===================================================================
Extension: pdf
===================================================================
https://above.nasa.gov/pdfs/20171020_ASC_Webinar.pdf
https://above.nasa.gov/safety/documents/Bear/bear_ID_brochure_BC.pdf
https://carbon.nasa.gov/pdfs/CMSAVtelecon_20150401_McKainSargent.pdf
https://fun3d.larc.nasa.gov/papers/LowPrecisionSolver.pdf
https://go.nasa.gov/385anj3
https://go.nasa.gov/42QfgGH
https://human-factors.arc.nasa.gov/publications/wenzel_1993_Localization_Head_Related.pdf
https://humansystems.arc.nasa.gov/publications/Barshi_Procedure_Checklist_Design_NASA_TM_2016.pdf
https://mars.nasa.gov/internal_resources/1489/
https://naif.jpl.nasa.gov/pub/naif/generic_kernels/spk/planets/de430_and_de431.pdf
https://nodis3.gsfc.nasa.gov/OPD_Docs/NAII_2800_2_.pdf
https://oig.nasa.gov/docs/IG-15-013.pdf
https://oig.nasa.gov/docs/IG-17-016.pdf
https://oig.nasa.gov/docs/IG-18-016.pdf
https://oig.nasa.gov/docs/IG-18-021.pdf
https://oig.nasa.gov/docs/IG-19-022.pdf
https://orbitaldebris.jsc.nasa.gov/library/usg_orbital_debris_mitigation_standard_practices_november_2019.pdf
https://s3vi.ndc.nasa.gov/ssri-kb/static/resources/529x0g1.pdf
https://sealevel.nasa.gov/internal_resources/535/Suva_Fiji_combined.pdf
https://smap.jpl.nasa.gov/files/smap2/SMAP_Handbook_FINAL_1_JULY_2014_Web.pdf
https://spacemath.gsfc.nasa.gov/moon/5Page28.pdf
https://spacemath.gsfc.nasa.gov/stars/5Page44.pdf
https://spacemath.gsfc.nasa.gov/stars/6Page106.pdf
https://spacemath.gsfc.nasa.gov/weekly/10Page55.pdf
https://spacemath.gsfc.nasa.gov/weekly/6Page89.pdf
https://spaceradiation.larc.nasa.gov/nasapapers/RP1257.pdf
https://spinoff.nasa.gov/back_issues_archives/1985.pdf
https://swift.gsfc.nasa.gov/analysis/xrt_swguide_v1_2.pdf
https://tmo.jpl.nasa.gov/progress_report2/42-44/44N.PDF
https://wind.nasa.gov/docs/MFI_Lepping_SSR1995.pdf
===================================================================
Extension: doc
===================================================================
https://acquisition.jpl.nasa.gov/download/terms-conditions/solicitation-group-a/A16-0359.doc
https://acquisition.jpl.nasa.gov/download/terms-conditions/solicitation-group-b/B13-2703.doc
https://acquisition.jpl.nasa.gov/download/terms-conditions/solicitation-group-b/B1-62-301.doc
https://acquisition.jpl.nasa.gov/download/terms-conditions/solicitation-group-b/B7-2891.doc
https://acquisition.jpl.nasa.gov/download/terms-conditions/supporting-documents/1047-NC.doc
https://acquisition.jpl.nasa.gov/download/terms-conditions/supporting-documents/JPL-Form-7112.doc
https://invention.nasa.gov/assets/downloads/nf1679.doc
===================================================================
Extension: docx
===================================================================
https://exoplanets.nasa.gov/internal_resources/1914/
===================================================================
Extension: txt
===================================================================
https://nrt3.modaps.eosdis.nasa.gov/archive/FIRMS/modis-c6.1/Canada/MODIS_C6_1_Canada_MCD14DL_NRT_2025329.txt
https://nrt3.modaps.eosdis.nasa.gov/archive/FIRMS/modis-c6.1/USA_contiguous_and_Hawaii/MODIS_C6_1_USA_contiguous_and_Hawaii_MCD14DL_NRT_2025314.txt
https://nrt3.modaps.eosdis.nasa.gov/archive/FIRMS/suomi-npp-viirs-c2/Northern_and_Central_Africa/SUOMI_VIIRS_C2_Northern_and_Central_Africa_VNP14IMGTDL_NRT_2025193.txt
https://www3.nasa.gov/robots.txt
===================================================================
Extension: xls
===================================================================
https://carbon.nasa.gov/files/tempfiles/cms_short_products_excel.xls
./GooFuzz -t nasa.gov -e wordlists/extensions.txt -k apikey.lst -o extensions.txt
Target: nasa.gov
https://history.nasa.gov/alsj/a11/A11_PressKit.pdf https://history.nasa.gov/alsj/a13/A13_PressKit.pdf https://history.nasa.gov/alsj/a14/A14_PressKit.pdf https://history.nasa.gov/alsj/a15/A15_PressKit.pdf https://history.nasa.gov/alsj/a410/A09_PressKit.pdf https://oig.nasa.gov/NASA2011MajorChallenges.pdf https://solarsystem.nasa.gov/stardust/aerogel_factsheet.pdf https://www.hq.nasa.gov/alsj/LLRV_Monograph.pdf
https://oig.nasa.gov/NASA_OIG_FY2013_Recovery_Act_Work_Plan.xls https://www.nasa.gov/xls/163559main_LunarExplorationObjectives.xls https://www.nasa.gov/xls/209970main_acr_section_c_icac_redacted_final_rev8_fixed.xls https://www.nasa.gov/xls/220716main_Ch2_6TV.xls https://www.nasa.gov/xls/279268main_Bird_Strikes.xls https://www.nasa.gov/xls/279283main_Collided_Nearly_Collided_With_Another_Aircraft_While_Both_on_Ground.xls https://www.nasa.gov/xls/279298main_Flight_Operations_Quality_Assurance_Program.xls https://www.nasa.gov/xls/279309main_Location_Aircraft_Unrequested_Clearance_Change.xls https://www.nasa.gov/xls/279532main_Runway_Taxiway_Excursions.xls https://www.nasa.gov/xls/279539main_Takeoffs_With_Out_of_Limit_Center_of_Gravity.xls
https://cce.nasa.gov/te2010_ab_presentations/Breakout_report.doc https://hdrl.gsfc.nasa.gov/LWS_Data_System_Final.doc https://pumas.nasa.gov/files/01_06_14_1.doc https://www.nasa.gov/279987main_0929MT.DOC https://www.nasa.gov/88878main_C_PDP03.DOC https://www.nasa.gov/doc/311200main_SELDP_Guideline_Rev_01262009.doc https://www.nasa.gov/doc/378831main_Huntsville_Transcript_part5.doc
https://aeronet.gsfc.nasa.gov/aeronet_locations.txt https://atmcorr.gsfc.nasa.gov/actual_holdings.txt https://fits.gsfc.nasa.gov/rfc4047.txt https://leonid.arc.nasa.gov/02comment66.txt https://leonid.arc.nasa.gov/99comment10.txt https://leonid.arc.nasa.gov/comment36.txt https://www.nasa.gov/190381main_Feldman-transcript.txt https://www.nasa.gov/366950main_1.txt https://www.nasa.gov/378571main_0728NASAMeeting.txt https://www.nasa.gov/382774main_081209_DC_Transcript.txt
## Elenca file, directory e persino parametri tramite una wordlist (si consiglia di utilizzare solo file molto piccoli).```console
> ./GooFuzz -t nasa.gov -e wordlists/words-100.txt -k apikey.lst -p 1
*********************************************************
* GooFuzz v.2.0 - The Power of Google Dorks *
*********************************************************
Target: nasa.gov
===================================================================
Directories and files found from: wordlists/words-100.txt
===================================================================
https://aeronet.gsfc.nasa.gov/cgi-bin/bamgomas_interactive
https://aeronet.gsfc.nasa.gov/cgi-bin/draw_map_display_aod_v3
https://aeronet.gsfc.nasa.gov/cgi-bin/webtool_aod_v3
https://cdaweb.gsfc.nasa.gov/cgi-bin/eval2.cgi
https://heasarc.gsfc.nasa.gov/cgi-bin/tess/webtess/wtv.py
https://heasarc.gsfc.nasa.gov/cgi-bin/Tools/convcoord/convcoord.pl
https://heasarc.gsfc.nasa.gov/cgi-bin/Tools/w3nh/w3nh.pl
https://heasarc.gsfc.nasa.gov/cgi-bin/Tools/w3pimms/w3pimms.pl
https://heasarc.gsfc.nasa.gov/cgi-bin/Tools/xraybg...
https://heasarc.gsfc.nasa.gov/cgi-bin/Tools/xraybg/xraybg.pl
https://heasarc.gsfc.nasa.gov/cgi-bin/W3Browse/swift.pl
https://heasarc.gsfc.nasa.gov/cgi-bin/W3Browse/w3browse.pl
https://heasarc.gsfc.nasa.gov/cgi-bin/W3Browse/w3catindex.pl
https://landweb.modaps.eosdis.nasa.gov/cgi-bin/QA_WWW/qaFlagPage.cgi?sat
https://landweb.modaps.eosdis.nasa.gov/cgi-bin/QA_WWW/qaFlagPage.cgi?sat=terra
https://landweb.modaps.eosdis.nasa.gov/cgi-bin/QA_WWW/qaFlagPage.cgi?sat=terra%26ver=C6
https://sscweb.gsfc.nasa.gov/cgi-bin/Locator.cgi
https://stereo.gsfc.nasa.gov/cgi-bin/images
https://stereo-ssc.nascom.nasa.gov/cgi-bin/images
https://svs.gsfc.nasa.gov/cgi-bin/details.cgi?aid
https://svs.gsfc.nasa.gov/cgi-bin/details.cgi?aid=4285
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=10G004
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=11G020
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=11G032
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=12G008
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=12G028
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=13G019
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=14G009
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=19G014
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=20G024
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=22G012
https://uavsar.jpl.nasa.gov/cgi-bin/data.pl?search=9G023
./GooFuzz -t nasa.gov -w adm,/login/,password,db.html -p 3 -k apikey.lst
Target: nasa.gov
https://ahed.nasa.gov/login https://airbornescience.nasa.gov/espo-auth/ajax-login https://c3.ndc.nasa.gov/dashlink/auth/login/ https://ceres-tool.larc.nasa.gov/ord-tool/jsp/Password.jsp https://dir.jpl.nasa.gov/PIV%20Smartcard%20Login%20for%20NASA%20Web%20Applications.pdf https://dir.jpl.nasa.gov/projects/Login.jsp https://gcn.nasa.gov/login https://gipoc.grc.nasa.gov/pbre/log/login.html https://guest.nasa.gov/forgot-password https://montepy.jpl.nasa.gov/login https://my.nasa.gov/s/login/? https://oltaris.nasa.gov/password/new https://software.nasa.gov/login https://sso1.jpl.nasa.gov/cgi-bin/session/login.cgi https://stemgateway.nasa.gov/login https://stemgateway.nasa.gov/public/s/login https://stemgateway.nasa.gov/public/s/login/SelfRegister https://subset.larc.nasa.gov/calipso/login.php https://uavsar.jpl.nasa.gov/cgi-bin/airborne-login.pl https://urs.earthdata.nasa.gov/login https://www.earthdata.nasa.gov/data/earthdata-login https://www.earthdata.nasa.gov/data/earthdata-login/guidance
## Esclusione di sottodomini nelle tue ricerche (separati da virgole o da un elenco)
### Esempio 1:
In questo esempio rimuoviamo il sottodominio "*www.earthdata.nasa.gov*" dalla ricerca.```console
> ./GooFuzz -t nasa.gov -w login -p 1 -k apikey.lst
*********************************************************
* GooFuzz v.2.0 - The Power of Google Dorks *
*********************************************************
Target: nasa.gov
===================================================================
Directories and files found from: login
===================================================================
https://firms.modaps.eosdis.nasa.gov/oauth/login?redirect=/api/auth/login/alerts/ed/
https://my.nasa.gov/s/login/?
https://software.nasa.gov/login
https://sso1.jpl.nasa.gov/cgi-bin/session/login.cgi
https://stemgateway.nasa.gov/public/s/login
https://urs.earthdata.nasa.gov/login
https://www.earthdata.nasa.gov/data/earthdata-login
https://www.earthdata.nasa.gov/engage/open-data-services-software/earthdata-developer-portal/earthdata-login-api
https://www.jpl.nasa.gov/site/NSET/accounts/login/
> ./GooFuzz -t nasa.gov -w login -p 1 -x www.earthdata.nasa.gov -k apikey.lst
*********************************************************
* GooFuzz v.2.0 - The Power of Google Dorks *
*********************************************************
Target: nasa.gov
===================================================================
Directories and files found from: login
===================================================================
https://ahed.nasa.gov/login
https://firms.modaps.eosdis.nasa.gov/oauth/login?redirect=/api/auth/login/alerts/ed/
https://my.nasa.gov/s/login/?
https://software.nasa.gov/login
https://sso1.jpl.nasa.gov/cgi-bin/session/login.cgi
https://stemgateway.nasa.gov/public/s/login
https://subset.larc.nasa.gov/calipso/login.php
https://urs.earthdata.nasa.gov/login
https://www.jpl.nasa.gov/site/NSET/accounts/login/
Usando l'esempio precedente, creiamo un file chiamato "exclusion_list.txt" e inseriamo i tre sottodomini da escludere, eseguiamo la stessa ricerca di nuovo, ma passando la lista dei target esclusi.```console
cat exclusion-list.txt daac.gsfc.nasa.gov invention.nasa.gov software.nasa.gov
./GooFuzz -t nasa.gov -w login -p 1 -x exclusion-list.txt -k apikey.lst
Target: nasa.gov
https://disc.gsfc.nasa.gov/earthdata-login https://ladsweb.modaps.eosdis.nasa.gov/oauth/login https://nightsky.jpl.nasa.gov/login.cfm https://podaac-tools.jpl.nasa.gov/drive/login?action https://podaac-tools.jpl.nasa.gov/drive/login?action=login https://stemgateway.nasa.gov/public/s/login/ https://technology.nasa.gov/login https://wiki.earthdata.nasa.gov/login.action https://www.earthdata.nasa.gov/eosdis/science-system-description/eosdis-components/earthdata-login https://www.jpl.nasa.gov/site/NSET/accounts/login/ https://www.sewp.nasa.gov/qrt/security/login.sa
## Enumerazione dei sottodomini
La funzionalità per elencare i sottodomini (parametro "*-s*") e, in combinazione con un numero di pagine compreso tra 10 e 20 (parametro "*-p*"), permette di ottenere un gran numero di sottodomini dell'organizzazione.```console
> ./GooFuzz -t nasa.gov -s -p 10 -k apikey.lst
*********************************************************
* GooFuzz v.2.0 - The Power of Google Dorks *
*********************************************************
Target: nasa.gov
===================================================================
Subdomains found:
===================================================================
above.nasa.gov
aeronet.gsfc.nasa.gov
appeears.earthdatacloud.nasa.gov
ares.jsc.nasa.gov
asterweb.jpl.nasa.gov
astrobiology.nasa.gov
esto.nasa.gov
explorers.gsfc.nasa.gov
eyes.nasa.gov
firms.modaps.eosdis.nasa.gov
go.nasa.gov
homeandcity.nasa.gov
imagine.gsfc.nasa.gov
lambda.gsfc.nasa.gov
oig.nasa.gov
plus.nasa.gov
science.nasa.gov
sdo.gsfc.nasa.gov
sealevel.nasa.gov
soma.larc.nasa.gov
space.jpl.nasa.gov
spacemath.gsfc.nasa.gov
spaceplace.nasa.gov
svs.gsfc.nasa.gov
swot.jpl.nasa.gov
technology.nasa.gov
terra.nasa.gov
worldwind.arc.nasa.gov
wvs.earthdata.nasa.gov
www.csbf.nasa.gov
www.earthdata.nasa.gov
www.jpl.nasa.gov
www.sewp.nasa.gov
La funzionalità di elencare i file in base al loro contenuto (parametro "-c"), è molto utile per identificare file rilevanti (ad esempio contenenti la parola "password"), anche se la parola si trova in un file immagine (ad esempio .png).```console
./GooFuzz -t nasa.gov -c password -k apikey.lst
Target: nasa.gov
https://cdaweb.gsfc.nasa.gov/WebServices/REST/idl/api/idldoc-index.html https://cdaweb.gsfc.nasa.gov/WebServices/REST/idl/public/idldoc-index.html https://cloud1.arc.nasa.gov/sonex/pages/sonex_data_exchg.html https://essp.larc.nasa.gov/EVM-3/pdf_files/N_PR_2200_002D_.pdf https://heasarc.gsfc.nasa.gov/docs/software/ftools/fv/doc/fileSelection.html https://hera.gsfc.nasa.gov/webHera/doc/webHera_1.fld/image004.png https://hera.gsfc.nasa.gov/webHera/doc/webHera_1.fld/image029.png https://hera.gsfc.nasa.gov/webHera/doc/webHera_1.fld/image068.png https://hera.gsfc.nasa.gov/webHera/doc/webHera_1.html https://modis-land.gsfc.nasa.gov/pdf/MODIS_C6_BA_User_Guide_1.0.pdf https://nodis3.gsfc.nasa.gov/NPD_attachments/Purchase.pdf https://nodis3.gsfc.nasa.gov/NPR_attachments/NRRS_1441.1.pdf https://ntrs.nasa.gov/api/citations/19960050121/downloads/19960050121.pdf https://procurement.ksc.nasa.gov/-/media/NPSC-SR/BiddersLibrary/DocumentLibrary/NRRS 14411 NASA Record Retention Schedules.ashx https://science.nasa.gov/files/atoms/files/Published HPAC FRN May 5-6 Meeting https://science.nasa.gov/files/atoms/files/Published HPAC FRN May 5-6 Meeting%5B1%5D.pdf https://www-air.larc.nasa.gov/pub/PEMTROPICSB/MODELING/KRISHNAMURTI.FSU/README.txt
#### Prova di concetto con un'immagine
O ancora, cerca una possibile password in un file pdf:```console
> ./GooFuzz -t .com -c changeme -e pdf
*********************************************************
* GooFuzz v.2.0 - The Power of Google Dorks *
*********************************************************
Target: .com
===================================================================
Extension: pdf
Files found containing: changeme
===================================================================
https://docs.itrsgroup.com/docs/geneos/4.4.0/SSO Agent/Geneos SSO User Guide v1.0.0.pdf
https://docs.oracle.com/cd/B31589_01/gc3/pdf/integration/gc3datamanagement.pdf
https://docs.vmware.com/en/VMware-Smart-Assurance/10.1.5/sm-pub-smarts-security-config-guide-1015.pdf
https://qsupport.quantum.com/kb/flare/Content/QEKM/Downloads/6-01847-02_Q-EKM_UsersGuide.pdf
https://www.cisco.com/c/en/us/td/docs/net_mgmt/broadband_access_center/3-6/administration/guide/admbac36/chap_20.pdf
https://www.delltechnologies.com/asset/en-us/products/data-protection/technical-support/docu96471.pdf
https://www.delltechnologies.com/asset/en-us/products/data-protection/technical-support/docu97051.pdf
https://www.delltechnologies.com/content/dam/digitalassets/active/en/unauth/technical-guides-support-information/products/data-protection/docu97051.pdf
https://www.delltechnologies.com/content/dam/digitalassets/active/en/unauth/technical-guides-support-information/products/data-protection/docu97085.pdf
Se ti piace lo strumento, lo trovi utile nel tuo lavoro, nel Bug Bounty o come hobby, potresti aiutarmi in questo modo:
