nu11secur1ty/insect고성능 웹 경로 탐색 및 디렉터리 무차별 대입 도구. 침투 테스트를 위해 사용자 정의 가능한 워드리스트, 필터, 재귀 스캔을 사용하여 숨겨진 파일, 디렉터리 및 엔드포인트를 발견합니다.
현재 릴리스: v1.4 (20222.09.03)
웹 서버의 디렉터리와 파일을 무차별 대입(brute force)하도록 설계된 고급 명령줄 도구, 일명 웹 경로 스캐너
아이디어 by @maurosoria and @shelld3v
Developement-2022는 @nu11secur1ty에 의해 활발히 개발되고 있습니다
요구 사항: python 3.10.5 이상
다음 설치 옵션 중 하나를 선택하세요:
git clone https://github.com/nu11secur1ty/insect.git --depth 1 (권장)docker build -t "insect:latest" . (자세한 정보는 여기에서 확인할 수 있습니다)pip3 install dirsearchsudo apt-get install dirsearch (지원 중단됨)요약:
%EXT% 키워드를 -e 플래그의 확장자로만 대체합니다.%EXT%가 없는 워드리스트(예: SecLists)의 경우, -f | --force-extensions 스위치를 사용하여 워드리스트의 모든 단어와 /에 확장자를 추가해야 합니다.wordlist1.txt,wordlist2.txt.예시:
확장자로 **asp**와 **aspx**를 전달하면 다음 사전이 생성됩니다:```
index
index.asp
index.aspx
**-f**/**--force-extensions** 플래그와 함께 **php** 및 **html**을 확장자로 전달하면 다음 사전이 생성됩니다:```
admin
admin.php
admin.html
admin/
**jsp** 및 **jspa**를 **-O**/**--overwrite-extensions** 플래그와 함께 확장자로 전달하면 다음 사전이 생성됩니다:```
login.html
login.jsp
login.jspa
옵션 -------``` Usage: insect.py [-u|--url] target [-e|--extensions] extensions [options]
Options: --version show program's version number and exit -h, --help show this help message and exit
Mandatory:
-u URL, --url=URL Target URL(s), support multiple flags
-l PATH, --url-file=PATH
URL list file
--stdin Read URL(s) from STDIN
--cidr=CIDR Target CIDR
--raw=PATH Load raw HTTP request from file (use --scheme flag
to set the scheme)
-s SESSION_FILE, --session=SESSION_FILE
Session file
--config=PATH Full path to config file, see 'config.ini' for
example (Default: config.ini)
Dictionary Settings:
-w WORDLISTS, --wordlists=WORDLISTS
Customize wordlists (separated by commas)
-e EXTENSIONS, --extensions=EXTENSIONS
Extension list separated by commas (e.g. php,asp)
-f, --force-extensions
Add extensions to the end of every wordlist entry. By
default insect only replaces the %EXT% keyword with
extensions
-O, --overwrite-extensions
Overwrite other extensions in the wordlist with your
extensions (selected via -e)
--exclude-extensions=EXTENSIONS
Exclude extension list separated by commas (e.g.
asp,jsp)
--remove-extensions
Remove extensions in all paths (e.g. admin.php ->
admin)
--prefixes=PREFIXES
Add custom prefixes to all wordlist entries (separated
by commas)
--suffixes=SUFFIXES
Add custom suffixes to all wordlist entries, ignore
directories (separated by commas)
-U, --uppercase Uppercase wordlist
-L, --lowercase Lowercase wordlist
-C, --capital Capital wordlist
General Settings: -t THREADS, --threads=THREADS Number of threads -r, --recursive Brute-force recursively --deep-recursive Perform recursive scan on every directory depth (e.g. api/users -> api/) --force-recursive Do recursive brute-force for every found path, not only directories -R DEPTH, --max-recursion-depth=DEPTH Maximum recursion depth --recursion-status=CODES Valid status codes to perform recursive scan, support ranges (separated by commas) --subdirs=SUBDIRS Scan sub-directories of the given URL[s] (separated by commas) --exclude-subdirs=SUBDIRS Exclude the following subdirectories during recursive scan (separated by commas) -i CODES, --include-status=CODES Include status codes, separated by commas, support ranges (e.g. 200,300-399) -x CODES, --exclude-status=CODES Exclude status codes, separated by commas, support ranges (e.g. 301,500-599) --exclude-sizes=SIZES Exclude responses by sizes, separated by commas (e.g. 0B,4KB) --exclude-texts=TEXTS Exclude responses by texts, separated by commas (e.g. 'Not found', 'Error') --exclude-regex=REGEX Exclude responses by regex (e.g. '^Error$') --exclude-redirect=STRING Exclude responses if this regex (or text) matches redirect URL (e.g. '/index.html') --exclude-response=PATH Exclude responses similar to response of this page, path as input (e.g. 404.html) --skip-on-status=CODES Skip target whenever hit one of these status codes, separated by commas, support ranges --min-response-size=LENGTH Minimum response length --max-response-size=LENGTH Maximum response length --max-time=SECONDS Maximum runtime for the scan