NOTICE:

This repository has been archived and is not supported.

Nightcall

Automated enumeration script built to reduce repetitive tasks during large black-box network pentests. Initial host discovery performed by basic throttled masscan, followed by service enumeration of each host, full port if host count less than a preconfigured constant, top port count otherwise. Nmap outputs are then parsed and common tooling queued up for follow up enumeration based on discovered service. All tasks after initial host discovery are multi-processed, with the task count being a configurable constant.

While actions and tooling are by no means exhaustive, tooling and configuration are meant to be easily configurable and modifiable to suit testers' needs. Most command configuration strings and wordlist selections are located at the beginning of the script. Nmap NSEs were selected for speed, safety, and usefulness. Nightcall is not meant as a replacement for vulnerability scanning solutions such as Tenable or OpenVAS, merely to fill a gap where manual testing efforts intersect. Additionally, Nightcall is focused more on understanding known IPv4 ranges than discovery of unknown subdomains. CaKinney's domained is a good option for that task.

Prereqs and Setup

Nightcall was built for use on Kali Linux. While it may function on alternate distros, certain tooling and pathing is assumed available outside setup. Because of the tooling and tasks performed, privileged root access is required. A code review is encouraged.

A goal was made to stay as close to out-of-the-box tooling as possible, but as development progressed minor additions were made to address challenges. Future improvements may address this by leveraging pre-installed solutions. For the time being, the following should install prerequisites. Again... a code review is encouraged.

root@kali:~# python3 nightcall.py --install-prereqs

Alternatively, prerequisites can be manually prepared.

root@kali:~# apt-get install python3-pip masscan nfs-common xvfb -yqq
root@kali:~# pip3 install tqdm

Running

While Nightcall has some basic progress metering, its meant more as a fire and review-later solution made for backgrounding with something like screen. The running log can be tailed during use.

By default, neither Medusa brute-forcing nor extended web checks with Wfuzz and Nikto will be performed. Those checks can be enabled by leveraging -w and -b respectively. If connecting over vpn use the -i switch to specify the interface to be used for masscan and nmap scans.

Nightcall was not built to handle resuming of previous sessions, but if a previous run was interrupted or follow-up testing needs to be performed, -sP can be leveraged to import nmap xml. Ensure an xml directory containing nmap xml exists in the working directory. Only the targets specified (-f or single address) will be imported from these xml files in order to facilitate selective follow up enumeration.

root@kali:~# python3 nightcall.py

usage: nightcall.py [-h] [-sP] [-i IFACE] [-f TARGET_FILE] [--install-prereqs]
                    [-b] [-w] [--disable-resolve]
                    [single_address]

positional arguments:
  single_address        single host or network (excludes -f)

optional arguments:
  -h, --help            show this help message and exit
  -sP, --skip-portscans
                        skip portscans, directly import xml
  -i IFACE, --iface IFACE
                        interface to use for masscan and nmap
  -f TARGET_FILE, --target-file TARGET_FILE
                        target file containing line separated ip addresses
                        (cidr supported)
  --install-prereqs     attempt to install TQDM progress bar, python3-pip,
                        masscan, nfs-common, xvfb
  -b, --brute           enable bruteforcing (consider lockouts)
  -w, --web             enable additional web related scans
  --disable-resolve     disable separate hostname resolution (outside nmap)

Tooling

masscan - host discovery amongst sparse ranges, throttled to reduce impact potential
nmap - service enumeration and select NSEs
whatweb - web technology identification
cutycapt - Image capture
enum4linux - smb/samba enumeration
dnsrecon - general dns zone xfer and ptr review
metasploit - additional auxiliary checks

Optional Web Checks

nikto - general web service enumeration
wfuzz - predictable content discovery
wafw00f - IDS / WAF detection
wpscan - wordpress enumeration
joomscan - joomla enumeration

Optional Brute-Forcing

medusa - optional brute-forcing attempts

Auxiliary MSF Modules

auxiliary/scanner/http/dir_listing
auxiliary/scanner/http/http_put
auxiliary/scanner/http/host_header_injection
auxiliary/scanner/http/smt_ipmi_49152_exposure
auxiliary/scanner/ipmi/ipmi_cipher_zero
auxiliary/scanner/ipmi/ipmi_dumphashes
auxiliary/scanner/ipmi/ipmi_version
auxiliary/scanner/misc/java_rmi_server
auxiliary/scanner/smtp/smtp_enum
auxiliary/scanner/snmp/snmp_login
auxiliary/scanner/ssh/ssh_enumusers
auxiliary/scanner/ssl/openssl_ccs
auxiliary/scanner/http/crawler (optional web)
auxiliary/scanner/http/jboss_vulnscan (optional web)
auxiliary/scanner/http/tomcat_mgr_login (optional web)
auxiliary/scanner/tftp/tftpbrute (optional brute)

Output

Tooling output will be collected and organized into the following subdirectories during enumeration by {host}-{port}.{type}, where type is some combination of categorization and tool depending on the application.

nmap - textual and greppable nmap output
xml - masscan and nmap xml
msf - metasploit module results
misc - various tooling output
http - web related output
http/images - screenshot captures
brute - brute-forcing results if selected

This approach was preferred over a by-host-subfolder strategy due to the massive number of directories that can be created and ease of grepping. Some minor summarization will be collected from specific files. Smaller engagements may benefit from Metasploit’s db_import of nmap xml, but for larger engagements leveraging a solution such as Offensive Elk, Moloch, or IVRE is recommended. A primary log file in the project directory contains a journal of commands executed and their associated timestamps.

Built With

tqdm

Known-Issues

Timeouts

Because timeouts and host connectivity can cause interuptions during enumeration of many hosts, a strategy of try / timeout / move-on was preferred rather than holding up other queued tasks. Most time-outs are configurable within the script.

Because Nightcall was created to handle large host-count engagements, small host count may cause masscan issues with timeout during initial host discovery. Timeout can be manually adjusted via constant in the script (DISCOVERY_WAIT), or a separate Nmap can be performed and imported leveraging the -sP switch described above.

Masscan has received bugfixes over the past year that appear to have improved this, but have not yet made it into Kali’s repository. It is highly recommended to build it from @ErrataRob’s repo should any host discovery issues be experienced. Additionally, ensure the correct interface has been specified with -i if scanning over a vpn connection.

Sanitization

While teaching us about rm, a wise man once followed the lesson with the adage "your gun... your foot". This script requires escalated privileges to run, and executes shell commands by design. Review it prior to running, be careful what you import, and where you aim.

License

This project is licensed under the Apache 2.0 license - see the LICENSE.md file for details.

Acknowledgements

Dori Clark, Caleb Ashe, David Winkle and others at Walmart Infosec Security Testing & Analysis for input and patience during alpha/beta testing.

Shout-out to @xer0dayz for Sn1per and BruteX. Dig the tools but had different needs. Imitation is the most sincere form of flattery 😁

walmartlabs / nightcall