Scout

Scout 是一个用于发现 Web 服务器上未公开的 VHOST、文件和目录的 URL 模糊测试器及爬虫。

完整的单词列表已内置于二进制文件中，这意味着最大程度的便携性和最少的配置。瞄准，开火！

用法


Usage:
  scout [command]

Available Commands:
  help        Help about any command
  url         Discover URLs on a given web server.
  version     Display scout version.
  vhost       Discover VHOSTs on a given web server.

Flags:
  -d, --debug             Enable debug logging.
  -h, --help              help for scout
  -n, --no-colours        Disable coloured output.
  -p, --parallelism int   Parallel routines to use for sending requests. (default 10)
  -k, --skip-ssl-verify   Skip SSL certificate verification.
  -w, --wordlist string   Path to wordlist file. If this is not specified an internal wordlist will be used.

发现 URL

标志

`-x, --extensions`

要检测的文件扩展名。（默认 php,htm,html,txt）

`-f, --filename`

在搜索的目录中寻找的文件名。当所有目录都返回 404 状态时很有用。

`-H, --header`

随请求发送的额外标头，例如 -H "Cookie: PHPSESSID=blah"

`-c, --status-codes`

表示成功发现的 HTTP 状态码。（默认 200,400,403,500,405,204,401,301,302）

`-m, --method`

要使用的 HTTP 方法。

`-s, --spider`

扫描页面内容以查找链接并确认其存在。

完整示例

$ scout url http://192.168.1.1
  
  [+] Target URL      http://192.168.1.1
  [+] Routines        10 
  [+] Extensions      php,htm,html 
  [+] Positive Codes  200,302,301,400,403,500,405,204,401,301,302
  
  [302] http://192.168.1.1/css
  [302] http://192.168.1.1/js
  [302] http://192.168.1.1/language
  [302] http://192.168.1.1/style
  [302] http://192.168.1.1/help
  [401] http://192.168.1.1/index.htm
  [302] http://192.168.1.1/image
  [200] http://192.168.1.1/log.htm
  [302] http://192.168.1.1/script
  [401] http://192.168.1.1/top.html
  [200] http://192.168.1.1/shares
  [200] http://192.168.1.1/shares.php
  [200] http://192.168.1.1/shares.htm
  [200] http://192.168.1.1/shares.html
  [401] http://192.168.1.1/traffic.htm
  [401] http://192.168.1.1/reboot.htm
  [302] http://192.168.1.1/debug
  [401] http://192.168.1.1/debug.htm
  [401] http://192.168.1.1/debug.html
  [401] http://192.168.1.1/start.htm
  
  Scan complete. 28 results found.

发现 VHOST

$ scout vhost https://google.com
  
  [+] Base Domain     google.com
  [+] Routines        10 
  [+] IP              -
  [+] Port            - 
  [+] Using SSL       true
  
  account.google.com
  accounts.google.com
  blog.google.com
  code.google.com
  dev.google.com
  local.google.com
  m.google.com
  mail.google.com
  mobile.google.com
  www.google.com
  admin.google.com
  chat.google.com
  
  Scan complete. 12 results found.

安装

curl -s "https://raw.githubusercontent.com/liamg/scout/master/scripts/install.sh" | bash

scout

最受欢迎

Scout

用法

发现 URL

标志

-x, --extensions

-f, --filename

-H, --header

-c, --status-codes

-m, --method

-s, --spider