th3-alch3m1st / minotaur

Dockerized automated scanning

Minotaur

An automated scanning tool using Dockers & RabbitMQ to help with bug bounties

The whole setup is based on workflows:

1. Passive Subdomains Enumeration -> Dedup & keep new ones -> shuffleDNS -> httprobe -> dirsearch
2. IP or Subnet -> Masscan -> Nmap Services -> Dirsearch http/https ports

Tools

• RabbitMQ
• Amass / Assetfinder / Findomain / Subfinder / Chaos
• Massdns / Nmap
• Dnsgen
• httprobe / anew
• Dirsearch

To Do

• Add Dirsearch implementation
• Add Rapid7 Sonar via Crobat
• Pull fresh Resolvers (via cronjob)
• Scan IP found from Massdns step for Open Ports (masscan / nmap)
• Add shuffleDNS & dnsvalidator tools to wrap arround Massdns
• Add waybackmachine/commoncrawl results
• Change dirsearch to ffuf, better html output

Instructions

1. git clone the repo
2. Put resolvers.txt in the docker/input/ directory, which you can get through a daily run of dnsvalidator
3. Put wordlist.txt in the docker/input/ directory, which is the list dirsearch will use
4. Results are stored in docker/output/ directory

• Build using --compatibility mode due to the use of replicas for dirsearch.

docker-compose --compatibility up --build

• At the moment you can run this using:

python app/send.py passive domain.com
python app/send.py ip-scan x.x.x.x/x <date>

Environment Variables

• You will need a key to run chaos project, create an env file in the root path and add a line with your key

CHAOS_KEY=key

Extra

• Dirsearch runs with 5 replicas, you can edit to add more or less.

Rabbitmq

Useful commands

Use docker-compose exec rabbitmq bash to get into the rabbitmq container

Use rabbitmqctl list_queues to get a list of all the queues and the number of messages they have

Use rabbitmqadmin get queue=dir-scan count=100 to list the last 100 entries in the dir-scan queue