orleven/tentacleTentacle — это фреймворк для проверки и эксплуатации уязвимостей на основе POC. Он поддерживает свободное расширение эксплойтов и использует POC-скрипты. Поддерживает вызовы API zoomeye, fofa, shodan и других сервисов для массовой проверки уязвимостей на нескольких целях.
.___________. _______ .__ __. .___________. ___ ______ __ _______
| || ____|| \ | | | | / \ / || | | ____| {1.0.0#stable}
`---| |----`| |__ | \| | `---| |----` / ^ \ | ,----'| | | |__
| | | __| | . ` | | | / /_\ \ | | | | | __|
| | | |____ | |\ | | | / _____ \ | `----.| `----.| |____
|__| |_______||__| \__| |__| /__/ \__\ \______||_______||_______| http://www.orleven.com
Tentacle — это фреймворк для проверки уязвимостей и эксплуатации POC. Он поддерживает свободное расширение эксплойтов и использует POC-скрипты. Поддерживает вызовы API zoomeye, fofa, shodan и других для выполнения массовой проверки уязвимостей для нескольких целей. (В разработке...)
pip3 install -r requestment.txt
При первом запуске файл конфигурации conf/tentacle.conf будет сгенерирован автоматически.
# Show help for tentacle.
python3 tentacle.py --help
# Show all modules, and you can see it in `script` path.
python3 tentacle.py --show
# Load target by iS/iN/iF/iT/iX/iE/gg/sd/ze/ff.
# Scan port and then it will try to send the poc.
python3 tentacle.py -m script/vul/web/web_status -iS www.examples.com # Load target by url or host
python3 tentacle.py -m script/vul/web/web_status -iF target.txt # Load target by file
python3 tentacle.py -m script/vul/web/web_status -iT dcc54c3e1cc2c2e1 # Load target by recode's target
python3 tentacle.py -m script/vul/web/web_status -iX nmap_xml.xml # Load target by nmap.xml
python3 tentacle.py -m script/vul/web/web_status -iE "powered by discuz" # Load target by baidu/bing/360so
python3 tentacle.py -m script/vul/web/web_status -gg 'intextdiscuz' # Load target by google api
python3 tentacle.py -m script/vul/web/web_status -sd 'apache' # Load target by shodan api
python3 tentacle.py -m script/vul/web/web_status -ze 'app:weblogic' # Load target by zoomeye api
python3 tentacle.py -m script/vul/web/web_status -ff 'domain="example.com"' # Load target by fofa api
# Load modules by -m (e.g. script/vul/web/web_status,@web)
python3 tentacle.py -iS 127.0.0.1 -m script/vul/web/web_status # Load web_status module
python3 tentacle.py -iS 127.0.0.1 -m @web # Load all module of web path
python3 tentacle.py -iS 127.0.0.1 -m script/vul/web/web_status,@web # Load all module of web path and web_status module
python3 tentacle.py -iS 127.0.0.1 -m "*" # Load all module of script path
python3 tentacle.py -iS 127.0.0.1 -m "*" -e @web # Load all module of script path, exclude all module of web path
# Set port scan scope
python3 tentacle.py -iS 127.0.0.1 -m script/vul/web/web_status # Scan top 150 ports and then perform bulk vulnerability verification for multiple targets.
python3 tentacle.py -iS 127.0.0.1 -m script/vul/web/web_status -sB # Skip port scan and then it will try the default port number server
python3 tentacle.py -iS 127.0.0.1 -m script/vul/web/web_status -lP 80-90,443 # Scan 80-90 ports and 443 port and then perform bulk vulnerability verification for multiple targets.
# Use function of modules by -m and -f (e.g. -m web_status -f prove), and you should make sure the function of module is exist.
python3 tentacle.py -m script/vul/web/web_status -f prove
# Show task's result by -tS
python3 tentacle.py -tS 8d4b37597aaec25e
# Export task's result by -tS to test.xlsx
python3 tentacle.py -tS 8d4b37597aaec25e -o test
# Export task's result by -tS to test.json
python3 tentacle.py -tS 8d4b37597aaec25e -oJ test
# Update by git
python3 tentacle.py --update