h4r5h1t/webcopilot하위 도메인을 열거한 후 xss, sqli, open redirect, lfi, ssrf 및 rce 파라미터를 필터링하고 취약점을 스캔하는 자동화 도구입니다.
기능 • 설치 • 사용법 • WebCopilot 실행 • 사용된 도구 • 감사의 말
WebCopilot은 대상의 서브도메인을 열거하고 다양한 오픈 소스 도구를 사용하여 버그를 탐지하도록 설계된 자동화 도구입니다.
이 스크립트는 먼저 assetfinder, sublister, subfinder, amass, findomain, hackertarget, riddler 및 crt를 사용하여 주어진 대상 도메인의 모든 서브도메인을 열거한 후, gobuster를 사용하여 SecLists 워드리스트로 활성 서브도메인 열거를 수행하고, dnsx를 사용하여 모든 활성 서브도메인을 필터링한 다음 httpx를 사용하여 서브도메인의 제목을 추출하고 subjack을 사용하여 서브도메인 탈취를 스캔합니다. 그런 다음 gau/gauplus, waybackurls 또는 waymore를 사용하여 주어진 서브도메인의 모든 엔드포인트를 크롤링하고, gf 패턴을 사용하여 해당 서브도메인에서 xss, lfi, ssrf, sqli, open redirect 및 rce 파라미터를 필터링한 후, 다양한 오픈 소스 도구(kxss, dalfox, openredirex, nuclei 등)를 사용하여 취약점을 스캔합니다. 그런 다음 스캔 결과를 출력하고 모든 출력을 지정된 디렉토리에 저장합니다.
g!2m0:~ webcopilot -h
──────▄▀▄─────▄▀▄
─────▄█░░▀▀▀▀▀░░█▄
─▄▄──█░░░░░░░░░░░█──▄▄
█▄▄█─█░░▀░░┬░░▀░░█─█▄▄█
██╗░░░░░░░██╗███████╗██████╗░░█████╗░░█████╗░██████╗░██╗██╗░░░░░░█████╗░████████╗
░██║░░██╗░░██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██╔══██╗██║██║░░░░░██╔══██╗╚══██╔══╝
░╚██╗████╗██╔╝█████╗░░██████╦╝██║░░╚═╝██║░░██║██████╔╝██║██║░░░░░██║░░██║░░░██║░░░
░░████╔═████║░██╔══╝░░██╔══██╗██║░░██╗██║░░██║██╔═══╝░██║██║░░░░░██║░░██║░░░██║░░░
░░╚██╔╝░╚██╔╝░███████╗██████╦╝╚█████╔╝╚█████╔╝██║░░░░░██║███████╗╚█████╔╝░░░██║░░░
░░░╚═╝░░░╚═╝░░╚══════╝╚═════╝░░╚════╝░░╚════╝░╚═╝░░░░░╚═╝╚══════╝░╚════╝░░░░╚═╝░░░
[●] Version: 2.0.0
[●] @h4r5h1t | G!2m0
[❌] Warning: Use with caution. You are responsible for your own actions.
[❌] Developers assume no liability and are not responsible for any misuse or damage cause by this tool.
Usage:
webcopilot -d <target>
webcopilot -d <target> -a
webcopilot [-d target] [-o output destination] [-t threads] [-b blind server URL] [-x exclude domains] [-f subdomains file] [-a] [-v] [-h]
Flags:
-d Add your target [Optional]
-o To save outputs in folder [Default: webcopilot-<timestamp>]
-t Number of threads [Default: 100]
-b Add your server for BXSS [Default: False]
-x Exclude out of scope domains [Default: False]
-f Specify a file containing subdomains, this will skip subdomain enumeration [Optional]
-a Run all Enumeration by default it will run only subdomain enumeration [Default: False][Time Consuming]
-v Show version of the tool
-h Show this help message
Example:./webcopilot -d domain.com -a -o domain -t 333 -x exclude.txt -b testServer.oast.fun
You can use https://app.interactsh.com/ to get your server
WebCopilot을 설치하려면 git이 필요합니다. root로 다음 명령을 실행하여 webcopilot을 설치하세요.
git clone https://github.com/h4r5h1t/webcopilot && cd webcopilot/ && chmod +x webcopilot install.sh && mv webcopilot /usr/bin/ && ./install.sh
[*] Installing Tools
[*] Creating Directories
[*] Installing Dependencies and Checking is Installed or Not
[*] git is already installed
[*] python3 is already installed
[*] python3-pip is already installed
[*] ruby is already installed
[*] golang-go is already installed
[*] snapd could not be found [*] Installing snapd
[*] snapd is not installed successfully, Please install it manually
[*] cmake is already installed
[*] jq is already installed
[*] gobuster is already installed
[*] chromium is already installed
[*] parallel is already installed
[*] Installing Python Tools
[*] Sublist3r could not be found [*] Installing Sublist3r
[*] Sublist3r is installed successfully
[*] sqlmap is already installed
[*] urldedupe is already installed
[*] openredirex is already installed
[*] waymore is already installed
[*] findomain is already installed
[*] uro is already installed
[*] Installing Wordlists and Payloads
[*] Skipping payloads/lfi.txt, already exists.
[*] Skipping resolvers.txt, already exists.
[*] Skipping subdomains.txt, already exists.
[*] Skipping fuzz.txt, already exists.
[*] Skipping dicc.txt, already exists.
[*] Skipping big.txt, already exists.
[*] Skipping dns.txt, already exists.
[*] Installing Go Tools
[*] anew is already installed
[*] gf is already installed
[*] aquatone could not be found [*] Installing aquatone
[*] aquatone is not installed successfully, Please install it manually
[*] assetfinder is already installed
[*] gau is already installed
[*] waybackurls is already installed
[*] httpx could not be found [*] Installing httpx
[*] httpx is not installed successfully, Please install it manually
[*] amass could not be found [*] Installing amass
[*] amass is not installed successfully, Please install it manually
[*] kxss is already installed
[*] subjack is already installed
[*] qsreplace is already installed
[*] dnsx could not be found [*] Installing dnsx
[*] dnsx is not installed successfully, Please install it manually
[*] dalfox is already installed
[*] crlfuzz is already installed
[*] nuclei could not be found [*] Installing nuclei
[*] nuclei is not installed successfully, Please install it manually
[*] subfinder could not be found [*] Installing subfinder
[*] subfinder is not installed successfully, Please install it manually
[*] Configuring Tools and Setting Up Environment
[*] All Tools are installed successfully