## 从 Dockerhub 使用 docker 容器```
docker pull sethsec/celerystalk:latest
docker run -p 27007:27007 -ti celerystalk

## 使用 celerystalk - 基础


### [URL 模式] - 如何扫描一个 URL（或文件中的多个 URL）

#### 启动所有启用的工具对一个 URL 或文件中的多个 URL 进行扫描，而无需导入范围、nmap 等。```
# ./celerystalk scan -u url or filename                 # Run all enabled commands against specified url(s)
# ./celerystalk query watch (then Ctrl+c)               # Wait for scans to finish
# ./celerystalk screenshots                             # Take screenshots
# ./celerystalk report                                  # Generate report

#### 或者，导入作用域内的主机列表，让celerystalk为你运行nmap```
# ./celerystalk import -S scope.txt                     # Import IP/CIDR/Ranges and mark as in scope
# ./celerystalk nmap                                    # Nmap all in-scope hosts (reads options from config.ini)

## Advanced Usage: Bug Bounty 模式 vs 漏洞评估模式

您在工作区实例化时定义模式。默认工作区为 VAPT 模式，但手动创建的工作区有两种选择。

* 如果您从范围内的 IP 地址/范围/CIDR 开始，请使用漏洞评估和渗透测试（VAPT）模式。
* 如果您从范围内的域名开始，请使用 Bug Bounty（BB）模式。

### [Bug Bounty 模式]

* 在 BB 模式下，使用 celerystalk 找到或手动导入的所有子域名都被标记为范围内。

#### 查找子域名，定义范围外的主机，扫描其余部分```
# ./celerystalk workspace create -o /dir -m bb          # Create default workspace and set output dir
# ./celerystalk subdomains -d company.com,dom.net       # Find subdomains and determine if in scope
# ./celerystalk import -S scope.txt     (optional)      # Import IP/CIDR/Ranges and mark as in scope
# ./celerystalk import -O out_scope.txt (optional)      # Define HOSTS/IPs that are out of scope
# ./celerystalk nmap                    (optional)      # Nmap all in-scope hosts (reads options from config.ini)
# ./celerystalk import -f client.xml    (optional)      # If you would rather import an nmap file you already ran
# ./celerystalk scan [--noIP]                           # Run all enabled commands against all in scope hosts
# ./celerystalk query watch (then Ctrl+c)               # Wait for scans to finish
# ./celerystalk screenshots                             # Take screenshots
# ./celerystalk report                                  # Generate report

**注意：** 您可以先运行子域名命令再定义范围，也可以先定义范围再导入子域名。  

#### 导入范围内主机列表，并让 celerystalk 运行 nmap 并解析结果```
# ./celerystalk workspace create -o /dir -m vapt        # Create default workspace and set output dir
# ./celerystalk import -S client-inscope-list.txt       # Import IP/CIDR/Ranges and mark as in scope
# ./celerystalk import -O out_scope.txt      (optional) # Define HOSTS/IPs that are out of scope
# ./celerystalk nmap                                    # Nmap all in-scope hosts (reads options from config.ini)
# ./celerystalk query watch (then Ctrl+c)               # Watch nmap scans as they move from pending > running > complete
# ./celerystalk subdomains -d client.com,client.net     # Find subdomains and determine if in scope
# ./celerystalk scan                                    # Run all enabled commands
# ./celerystalk query watch (then Ctrl+c)               # Watch scans as they move from pending > running > complete
# ./celerystalk screenshots                             # Take screenshots
# ./celerystalk report                                  # Generate report

#### import
此命令允许您将端口和主机数据导入 celerystalk，并允许您定义哪些在范围内，哪些不在范围内。

| 选项 | 描述 |
| --- | --- |
| -f scan.xml | <b>Nmap/Nessus xml</b><br><ul><li>将从此文件中的所有 IP 地址添加到 hosts 表，并将其全部标记为在范围内以供扫描。</li><li>将所有端口和服务类型添加到 services 表。</li></ul> |
| -S scope.txt | <b>范围文件</b><br><ul><li>显示尚未暂存的文件差异</li></ul>|
| -D subdomains.txt | <b>（子）域名文件</b><br><ul><li>celerystalk 通过解析 IP 并在数据库中查找 IP 来确定每个子域名是否在范围内。如果匹配，则该域名被标记为在范围内并将被扫描。</li></ul>|```
Import Nmap XML file:       ./celerystalk import -f /assessments/nmap.xml 
Import Nessus file:         ./celerystalk import -f /assessments/scan.nessus 
Import list of Domains:     ./celerystalk import -D <file>
Import list of IPs/Ranges:  ./celerystalk import -S <file>
Specify workspace:          ./celerystalk import -f <file>     
Import multiple files:      ./celerystalk import -f nmap.xml -S scope.txt -D domains.txt

#### nmap
这个命令将使用您在 config.ini 文件中指定的选项为您运行 nmap。您也可以从 nmap xml 文件或 .nessus 文件导入端口扫描数据。
     
| 选项 | 描述 |
| --- | --- |
| 无选项 | 从配置中读取 nmap 命令并扫描范围内主机的所有服务 |
| -c [filename] | 指定 celerystalk 配置文件 [默认: ./config.ini]

#### scan
这个命令将任务提交给 celery，celery 异步执行它们并将输出记录到您的输出目录。

| 选项 | 描述 |
| --- | --- |
| 无选项 | <b>扫描所有范围内主机</b><ul><li>读取数据库并扫描每个范围内的 IP 和子域名。</li><li>对 IP 启动所有启用的工具，但仅对虚拟主机使用 http/http 特定工具</li></ul>   |
| --noIP      | 不要按 IP 扫描主机（仅扫描虚拟主机）
| -t ip,vhost,cidr | <b>从数据库或扫描文件扫描特定目标</b><ul><li>扫描范围内 IP 和/或子域名的子集</li></ul> |  
| -s | <b>模拟</b><br> 将所有任务发送给 celery，但所有命令前都加上了 # 前缀，使其失效</li></ul> |
| -c [filename]   | 指定 celerystalk 配置文件 [默认: ./config.ini]          |
| -u [URL]     | 扫描特定 URL，即使它尚未存在于数据库中                      |```    
Scan all in scope hosts:    ./celerystalk scan    
Scan subset of DB hosts:    ./celerystalk scan -t 10.0.0.1,10.0.0.3
                            ./celerystalk scan -t 10.0.0.100-200
                            ./celerystalk scan -t 10.0.0.0/24
                            ./celerystalk scan -t sub.domain.com
Simulation mode:            ./celerystalk scan -s

                       ./celerystalk rescan -c myconfig.ini

#### query 
根据您的需求异步检查任务队列的状态。监视模式实际上执行的是linux的watch命令，这样就不会填满整个终端缓冲区。
     
| Option | Description |
| --- | --- |
| no options | 显示当前工作区中的所有任务 |
| watch | 向unix的watch命令发送指令，每2秒更新一次状态 |
| brief | 每个状态（待处理/运行中/已完成/已取消/已暂停）最多显示5条结果 |
| summary | 仅显示包含数字的横幅，不显示任务本身 |```
Query Tasks:                ./celerystalk query 
                            ./celerystalk query watch                               
                            ./celerystalk query brief
                            ./celerystalk query summary                                
                            ./celerystalk query summary watch

                        ./celerystalk <verb> all                #Cancel/Pause/Resume all tasks from current workspaces

#### 截图

|  选项  | 描述                           |
| --- | --- |
| 无选项 | 为所有已知路径截图 |```
    ./celerystalk screenshots

#### db
列出或导出存储在 celerystalk 数据库中的工作区、主机、服务或路径

| Option | Description |
| --- | --- |
| workspaces | 显示所有已知工作区及每个工作区关联的输出目录 |
| workspace | 同 workspaces |
| services | 按 IP 显示所有已知开放端口和服务类型 |
| ports    | 同 ports.                                                         |
| hosts | 显示所有主机（IP 地址和子域名/虚拟主机）以及它们是否在范围内、是否已提交扫描 |
| vhosts   | 同 hosts 命令，但排除作为 IP 地址的虚拟主机。      |
| paths | 显示由虚拟主机识别出的所有路径 |
| paths_only | 显示数据库中换行分隔的路径列表。适用于管道传输到其他工具 |
| export | 导出服务、主机和路径表
| export_paths_only | 仅将数据库中换行分隔的路径列表导出到文件。```
Show workspaces:            ./celerystalk db workspaces
                            ./celerystalk db workspace
Show services:              ./celerystalk db services
                            ./celerystalk db ports
Show hosts:                 ./celerystalk db hosts
Show vhosts only            ./celerystalk db vhosts
Show paths:                 ./celerystalk db paths
Show paths (no table)       ./celerystalk db paths_only     
Show tasks:                 ./celerystalk db tasks
Export tables to csv        ./celerystalk db export
Export paths to txt         ./celerystalk db export_paths_only

## 用法```
Usage:
    celerystalk workspace ([create]|[switch]) [-w workspace_name] [-o <output_dir>] [-m <mode>] [-h]
    celerystalk import [-f <nmap_file>] [-S scope_file] [-D subdomains_file] [-O outOfScope.txt] [-u <url>] [-h]
    celerystalk subdomains [-d <domains>] [-c <config_file>] [-s] [-h]
    celerystalk nmap [-t <targets>] [-c <config_file>] [-s] [-h]
    celerystalk scan [-t <targets>] [--noIP] [-c <config_file>] [-s] [-h]
    celerystalk scan -u <url> [-c <config_file>] [-s] [-h]
    celerystalk rescan [-t <targets>] [-c <config_file>] [-s] [-h]
    celerystalk query ([full] | [summary] | [brief]) [watch] [-h]
    celerystalk query [watch] ([full] | [summary] | [brief]) [-h]
    celerystalk report [-h]
    celerystalk screenshots [-h]
    celerystalk cancel ([all]|[<task_ids>]) [-h]
    celerystalk pause  ([all]|[<task_ids>]) [-h]
    celerystalk resume ([all]|[<task_ids>]) [-h]
    celerystalk db ([workspaces]|[workspace]|[services]|[ports]|[hosts]|[vhosts]|[paths]|[paths_only]|[tasks]) [-h]
    celerystalk db export [-h]
    celerystalk admin ([start]|[stop]|[restart]|[reset]|[backup]|[restore]) [-f <restore_file>] [-h]
    celerystalk interactive [-h]
    celerystalk (help | -h | --help)

Options:
    -h --help           Show this screen
    -v --version        Show version
    -f <nmap_file>      Nmap xml import file
    -c <config_file>    Specify a non-default configuration file  by name
    -o <output_dir>     Output directory
    -m <mode>           vapt = VulnAssmt/PenTest, bb = Bug Bounty
    -S <scope_file>     Scope import file
    -O <outscope_file>  Out of scope hosts file
    -D <subdomains_file> Subdomains import file
    -t <targets>        Target(s): IP, IP Range, CIDR
    -u <url>            URL to parse and scan with all configured tools
    -w <workspace>      Workspace
    -d --domains        Domains to scan for vhosts
    -s --simulation     Simulation mode.  Submit tasks comment out all commands
    --noIP              Only scan targets by DNS hostname (Don't scan the IP address)

Context specific help with examples:

    ./celerystalk workspace -h
    ./celerystalk subdomains -h
    ./celerystalk import -h
    ./celerystalk nmap -h
    ./celerystalk scan -h
    ./celerystalk rescan -h
    ./celerystalk query -h
    ./celerystalk pause -h
    ./celerystalk resume -h
    ./celerystalk cancel -h
    ./celerystalk db -h
    ./celerystalk screenshots -h
    ./celerystalk report -h
    ./celerystalk admin -h