crimson: Automated Scanner for Pentesters and Bug Bounty Hunters


Crimson is a complete pentest suite, with a wide variety of programs and options, that meets the needs of even the most demanding hacker. It has programs from different categories such as network scan, phishing, exploitation etc.

It is an open source program, written in python.

crimson logo

Installation

# 1. Pull docker container: docker pull karmaz95 / crimson: v1 # 2. First run of downloaded container: docker run --network = "host" --name crimson -it karmaz95 / crimson: v1 # 3. After first run you can start container by: docker start crimson && docker attach crimson # 4. If you need to copy output from container: docker cp crimson: /root/bounty/domain.name

Use

crimson_recon -D "domain.com" 
                   
                   # Optional flags are shown below: 
                -x # Domain bruteforcing (with words / dns wordlist)
                -v # Virtual host discovering
                -p # TCP ports scanning (1-65535)
                -u # UDP ports scanning (nmap default ports)
                -b # Third level subdomain bruteforcing
                -y # Proxy urls.txt and live.txt to Burp (127.0.0.1:8080)
                -s # Find hidden subdomains and secrets within urls.txt with SubDomainizer (takes very long time)

crimson_target -D "example.domain.com" 
                    
                    # Optional flags are shown below:
                 -c "Cookie: auth1 = 123;"
                 -p # TCP (1-65535) ports scanning
                 -u # UDP (nmap default) ports scanning
                 -a # Without this flag, you have to manually check for false-positives after bruteforcing
                 -y # Proxy urls.txt and ffuf.txt to Burp (127.0.0.1:8080)
                 -b # Parameter bruteforcing with Arjun

crimson_exploit -D "example.domain.com" -d "collaborator.com" -i "ip"
                    
                    # Optional flags are shown below:
                  -c "Cookie: auth1 = 123;"
                  -x # fuzzing all.txt with bug wordlist

Modules

### FUNCTIONS: # # 1. SUBDOMAIN ENUMERATION # 2. LIVE SUBDOMAIN CHECK # 3. TAKEOVER CHECK # 4. SCREENSHOTS # 5. CORS CHECK # 6. IP RESOLVE # 7. OPENED PORTS SCAN # 8. URLS SCRAPING # 9. API KEYS SCRAPING # 10. VIRTUAL HOSTNAMES ENUMERATION # ### LISTS (output): # # 1. live.txt - LIVE SUBDOMAINS # 2. ip.txt - ALL IPs # 3. ports.txt - OPENED PORTS # 4. subjack .txt - VULNS [TAKEOVER] # 5. screenshots - STATUS CODES + SCREENS # 6. cors_scan.txt - VULNS [CORS] # 7. urls.txt - ALL CRAWLED AND LIVE URLS IN ONE FILE # 8. status_live.txt - HTTPS / HTTPS SUBDOMAINS STATUS CODES # 9. ldns-walk.txt - DOMAINS FROM DNSSEC # 10. subdomainizer.txt - DETECTED API KEYS / AND MORE SUBDOMAINS # 11. hosthunter.txt - VIRTUAL HOSTNAMES # 12. nucleve.t ### WORKFLOW # # 1. Start Burp Suite - optional step # - Create new project - example.tld # - Turn off interception # 2. Start this script. # 3. Check the output listed above (LISTS) # 4. Select single domain and start crimson_target module # ###
### FUNCTIONS: # # 1. FULL RANGE PORT SCANING && NSE ON OPENED PORTS # 2. VULNERABILITY SCANING # 3. DOMAIN CRAWLING # 4. DIRECTORY BRUTEFORCING # 5. GATHERING SOURCE CODE OF SCRAPED / BRUTEFORCATH , API KEYS, ENDPOINTS FROM GATHERED SOURCE CODE # 6. MERGING PATHS WITH DOMAIN AND PROBING FOR NEW ENDPOINTS # 7. PROXING LIVE RESULTS TO BURP SUITE # 8. PREPARING params.txt && dirs.txt FOR EXPLOF 9. POTENTIAL BACKUP FILES && CMS # 10. TESTING HOP-BY-HOP DELETION # ### LISTS: # # 11) recon.txt - FILE WITH RECON OUTPUT # 1) urls.txt - FILE WITH GATHERED URLS # 2) status_params.txt - STATUS CODES OF urls.txt # 3) ffuf.txt - DIR BRUTEFORCING OUTPUT # 4) status_dir.txt - STATUS CODE OF ffuf.txt # 5) exp / params.txt - FILE PREPARED FOR crimson_exploit WITH PARAMS # 9) exp / dirs.txt - FILE PREPARED FOR crimson_exploit WITH DIRECTORIES # 10) backups.txt - POTENTIALLY BACKUP FILES # 11) arjun.txt - FILE WITH BRUTEFORCED PARAMETERS # 12) nmap.txt - FILE WITH TCP / UDP PORT SCANNING OUTPUT # 13) exp / nmap.gnmap - FILE WITH TCP / UDP PORT SCANNING OUTPUT IN GREPABLE FORMAT # ### WORKFLOW # # 15. Start Burp - optional step # - Create new project - www. example.tld # - Turn off interception # - Make active scan for proxied urls only in scope # 0. Start the script # - If you did not choose -a flag, go to /bounty/domain.tld/tested.domain. tld / temp and remove manually false positives entries in ferox.txt # 1. Check the output listed above (LISTS) # 2. Manually browse the application, click on all functionalities # 3. Copy whole target scope from Burp after manually browsing the target # 4. Paste it to exp / all.txt and run crimson_exploit # ###
### FUNCTIONS: # # 1. FUZZING PATHS IN URLS FROM dirs.txt WITH CUSTOM PAYLOADS # 2. FUZZING PARAMS IN URLS FROM params.txt WITH CUSTOM PAYLOADS # 3. TESTING FOR XSS # 4. TESTING JAVASCRIPT SOUR. TESTING HTTP REQUEST SMUGGLING # 5. TESTING PROTOTYPE POLLUTION # 6. TESTING FOR BROKEN LINKS # 7. TESTING SQLI # 8. TESTING OUT-OF-BOUND RCE / SSRF # 9. TESTING JAVA DESERIALIZATION # 10. TESTING CRLF INJECT FOR OPEN REDIRECTION # 11. TESTING WORDPRESS # 12. TESTING CVES # 13. TESTING HEADER INJECTIONS # ### LISTS: # # 14. bug_params.txt - Fuzzing output # 15. bug_dirs.txt - Fuzzing output # 1. vuln_xss - Output from XSSstrike with vulnerable urls ready to open in browser # 2. codeql.txt - Output from Codeql after testing the JavaScript source code. # 3. Smuggler.txt - Output after testing for HTTP request smuggling. # 4. Prototype-pollution - Potentailly vulnerable params to prototype pollution. # 5. broken_links.txt - Output from BLC # 6. sqli / - Output from sqlmap # 7. oob.txt - Log after OAST # 8. CRLF.txt - Output from crlfuzz # 9. OR.txt - Potentailly vulnerable URLs to Open Redirect vulnerability # 10. dalfox.txt - Output from dalfox # 11. ssti.txt - Output from crimson_templator with SSTI vulnerable urls. # 12. wp / - Output from WPSCAN # 13. deserializator.txt - Logs from crimson_deserializator # 14. semgrep.txt - Output from semgrep after testing the JavaScript source code. # 15. nuclei.txt - Output from nuclei scanning # 16. headi.txt - Otput from headi # ### WORKFLOW # # 17. Start BURP - optional step # 18. Start vps listener and collaborator server # 0. Start the script # 1. Check the output listed above (LISTS) # 2. Look for [ID] [TIME] in oob.txt and compare it to pings on your vps / collaborator # 3. Check deserialization pings with manual payloads # 5. Start manual testing # ###

Characteristics

Domains enumeration:

 IP && ports:

 URLs:

 Target visualization:

 Bug finding:

 WordPress tools:

 Additional tools:

 Wordlists:

 Burp Suite extensions:

 

You can download the program from here.


Read them Technology News from all over the world, with the validity of iGuRu.gr

Follow us on Google News iGuRu.gr at Google news