OG AUTO-RECON: A Scanner based on Nmap

<span class="pl-c1">cd</chip> / opt

git clone https://github.com/Knowledge-Wisdom-Understanding/recon.git

<span class="pl-c1">cd</chip> recon

chmod + x setup.sh

./setup.sh

python3 setup.py 

_____________ ____ ________________

      /___/___ \        /  / |  /___/__ \ Mr.P-Millz _____

      O.G./  /   _ \ ______/__/  |______|__|_____ *   \ _________________/__/  |___

       __/__/   /_ \ \ |  |  \ __ \/  _ \|  |       __/ __ \ _/ ___ \/  _ \|       |

      |   |     ___ \|  |  /|  | (  |_| )  |    |   \ ___/\ \ __(  |_| )   |   |

      |___|____/\ __ \ ____|____/_|__|\ _ \ ____/|__|____|_  /\ ___  |\ ___ \ ____/|___|  /

      gtihub.com/Knowledge-Wisdom-Understanding \ ___ \/  \ __ \/  \ __ \ _/ v3.6 \ ___ \/

usage:  autorecon -t 10.10.10.10

An Information Gathering and Enumeration Framework

optional arguments:

  -h, --help show this help message and exit

  -t TARGET, --target TARGET

                        Single IPv4 Target to Scan

  -F, --FUZZ auto fuzz found urls ending with .php for params

  -v, --version Show Current Version

  -f FILE, --file FILE File of IPv4 Targets to Scan

  -w [WEB], --website [WEB]

                        Get open ports for IPv4 address, then only Enumerate

                        Web && amp; and Dns Services. -t,--target must be specified.

                        -w, --web takes a URL as an argument. i.e. python3

                        recon.py -t 10.10.10.10 -w secret

  -i {http, httpcms, ssl, sslcms, aquatone, smb, dns, ldap, removecolor, oracle, source, sort_urls, proxy, proxycms, fulltcp, topports, remaining, searchsploit, peaceout, ftpAnonDL, winrm} [{http, httpcms, ssl, sslcms, aquatone, smb, dns, ldap, removecolor, oracle, source, sort_urls, proxy, proxycms, fulltcp, topports, remaining, searchsploit, peaceout, ftpAnonDL, winrm} ...], --ignore {http, httpcms, ssl, sslcms, aquatone, smb, dns, ldap, removecolor, oracle, source, sort_urls, proxy, proxycms, fulltcp, topports, remaining, searchsploit, peaceout, ftpAnonDL, winrm} [{http, httpcms, ssl, sslcms, aquatone, smb, dns, ldap, removecolor, oracle, source, sort_urls, proxy, proxycms, fulltcp, topports, remaining, searchsploit, peaceout, ftpAnonDL, winrm} ...]

                        Service modules to ignore during scan.

  -s {http, httpcms, ssl, sslcms, aquatone, smb, dns, ldap, removecolor, oracle, source, sort_urls, proxy, proxycms, fulltcp, topports, remaining, searchsploit, peaceout, ftpAnonDL, winrm} [{http, httpcms, ssl, sslcms, aquatone, smb, dns, ldap, removecolor, oracle, source, sort_urls, proxy, proxycms, fulltcp, topports, remaining, searchsploit, peaceout, ftpAnonDL, winrm} ...], --service {http, httpcms, ssl, sslcms, aquatone, smb, dns, ldap, removecolor, oracle, source, sort_urls, proxy, proxycms, fulltcp, topports, remaining, searchsploit, peaceout, ftpAnonDL, winrm} [{http, httpcms, ssl, sslcms, aquatone, smb, dns, ldap, removecolor, oracle, source, sort_urls, proxy, proxycms, fulltcp, topports, remaining, searchsploit, peaceout, ftpAnonDL, winrm} ...]

                        Scan only specified service modules

  -b {ftp, smb, http, ssh}, --brute {ftp, smb, http, ssh}

                        Experimental! - Brute Force ssh, smb, ftp, or http. -t,

                        --target is REQUIRED. Must supply only one protocol at

                        a team. For ssh, first valid users will be enumerated

                        before password brute is initiated, when no user or

                        passwords are supplied as options.

  -p PORT, --port PORT port for brute forcing argument. If no port specified,

                        default port will be used

  -in USER, --user USER Single user name for brute forcing, for SSH, if no

                        user specified, will default to

                        wordlists/usernames.txt and bruteforce usernames

  -U USERS, --USERS USERS

                        List of usernames to try for brute forcing. Not yet

                        implimented

  -P PASSWORDS, --PASSWORDS PASSWORDS

                        List of passwords to try. Optional for SSH, By default

                        wordlists/probable-v2-top1575.txt will be used.