vide.sh

Tool to probe and crawl targets and enumerate their attack surface using varous engines. Inputs can be:

.xml files generated by nmap
- vide.sh nmap -sc -sp -eu -ew
a list of targets
- vide.sh scope.txt -sp -sc -ev
stdin
- echo example.com | vide.sh -sp -es --config custom.sh
direct
- vide.sh "10.0.13.37:8443" -el

      _______________
  ==c(___(o(______(_()
          \=\
           )=\    ┌─────────────────────────~vide~────┐
          //|\\   │ attack surface enumeration        │
         //|| \\  │ version: 2.2                      │
        // ||. \\ └─────────────────@dreizehnutters───┘
      .//  ||   \\ .
      //  .      \\

This is yet another ctf/engagement automation tool, born out of curiosity and boredom. This tool was inspired by six2dez/reconftw.

Usage

Usage: vide.sh input [mods] [options] [misc]

Required:
    input   Specify an input format (e.g., file/path, string or stdin)

Mods:
    -sp     Skip probing with httpx
    -sc     Skip crawling with katana

Options:
    -es     Enable screenshot
    -ew     Enable whatweb scans
    -ea     Enable wanalyze scans
    -en     Enable nmap script scans
    -eu     Enable nuclei scans
    -ei     Enable nikto scans
    -ef     Enable ffuf brute forcing
    -ev     Enable virtual host header fuzzing
    -ej     Enable js crawl
    -eb     Enable bypass scans
    -el     Enable testssl.sh scans
    -eh     Enable ssh-audit scans

Misc:
    -h|--help                  Show this message
    -c|--config  <config.sh>   Config file to pass (default: custom.sh)
    -o|--out-dir <path>        Out-dir to work in (default: $PWD)
    --verify                   Check configuration file (default: config.sh)

Example:
    # skip crawl, skip probing, do virtual host header scan on a list of targets
    vide.sh scope.txt -sp -sc -ev
    # skip crawl, do nuclei, do whatweb on nmap output directory
    vide.sh nmap -sc -eu -ew
    # with config skip probing, do screenshot on stdin (default to HTTP)
    echo example.com | vide.sh -sp -es --config custom.sh
    # ssl scan on target
    vide.sh '10.0.13.37:8443' -el
    # verify current config.sh
    vide.sh --verify

Example

# skip crawling, do httpX screenshots and WhatWeb scans on nmap -oX data
$ vide.sh nmap -sc -es -ew
[...]

$ tree .
├── nmap
│   └── init.xml
└── vide_runs
    └── vide_22.02_23301708641003
        ├── host_port.txt
        ├── http_servers.txt
        ├── https_servers.txt
        ├── httpx
        │   └── scan.log
        ├── screenshots
        │   ├── response
        │   │   ├── 192.168.42.131
        │   │   │   └── 628362c5635403dbffbf03eb624e464b50915bc4.txt
        │   │   └── index.txt
        │   └── screenshot
        │       ├── 192.168.42.131
        │       │   └── 628362c5635403dbffbf03eb624e464b50915bc4.png
        │       ├── index_screenshot.txt
        │       └── screenshot.html
        ├── vide.log
        ├── vide_targets.txt
        └── whatweb
            ├── brief_all.log
            ├── brief.log
            ├── deep_all.log
            └── deep.log

Installation

The installtion and maintance of used modules by vide.sh is left to the user

$ git clone https://github.com/dreizehnutters/vide
$ cd vide
$ ln -s $(pwd)/vide.sh ~/.local/bin/vide.sh
$ vide.sh --verify

Configuration

One has to edit the config.sh to adjust the location of used binaries and configure extra parameter about each engine

cat config.sh| head -n15
# ---= bins =--- #CHANGE ME
NMAP=/usr/bin/nmap
XMLS=/usr/bin/xmlstarlet
NIKTO=/usr/bin/nikto
WW=/usr/bin/whatweb
WA=/usr/local/bin/webanalyze
SMBMAP=/usr/bin/smbmap
ENUM4LINUX=$PY_PATH/enum4linux-ng.py
FFUF=$GO_PATH/bin/ffuf
BYP4=$GO_PATH/bin/byp4xx
SUBJS=$GO_PATH/bin/subjs
HTTPX=$HOME/.pdtm/go/bin/httpx
NUCLEI=$HOME/.pdtm/go/bin/nuclei
KATANA=$HOME/.pdtm/go/bin/katana

# check the current configuration
$ vide.sh --verify

Scanning Engines

Software	Version	Install
`xmlstarlet`	>= `1.6.1`	XML parsing
`httpx`	>= `1.2.5`	server probing
`katana`	>= `1.0.0`	crwaling
`whatweb`	>= `0.5.5`	tech discovery
`webanalyze`	>= `0.3.8`	tech discovery
`nuclei`	>= `2.8.9`	web server scanning
`nikto`	>= `2.5.0`	web server scanning
`ffuf`	>= `2.0.0`	directory brute forcing
`byp4xx`	>= `b337580`	bypass checks
`subjs`	>= `1.0.0`	crawling js
`enum4linux-ng.py`	>= `1.3.1`	windows enumeration
`smbmap`	>= `1.9.1`	smb enumeration
`nmap`	>= `7.94`	extended script scans
`testssl.sh`	>= `3.2rc3`	SSL compliance scans
`ssh-audit`	>= `3.1.0`	SSH compliance scans

dreizehnutters / vide