Dheerajmadhukar/Lilly

Stars
168
Rank 218,910 (Top 5 %)
Language
Shell
License
MIT License
Created over 3 years ago
Updated over 3 years ago

Dheerajmadhukar/Lilly

Dheerajmadhukar

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Tool to find the real IP behind CDNs/WAFs like cloudflare using passive recon by retrieving the favicon hash. For the same hash value, all the possible IPs, PORTs and SSL/TLS Certs are searched to validate the target in-scope.

Last updated on 2020/12/29

Introduction

Lilly Tool to find the real IP behind CDNs/WAFs like cloudflare using passive recon by retrieving the favicon hash. For the same hash value, all the possible IPs, PORTs and SSL/TLS Certs are searched to validate the target in-scope.

Usage

root@me_dheeraj:$ bash lilly.sh
[-] Argument: -d/--domain target.com -a/--api Required

       Usage: ./lilly.sh -d/--domain target.com -a/--api premium_api

Output will be saved in output/target.com-YYYY-MM-DD directory

Prerequisites

python3
jq
pip3 install shodan
pip3 install mmh3
Shodan Member Account & API
httpx @pdiscoveryio
Multi-Threading interlace - @codingo

Tool of the week

https://blog.intigriti.com/2021/01/06/bug-bytes-104-cache-poisoning-dos-burp-themes-a-couple-of-facebook-account-takeovers/

4-ZERO-3

403/401 Bypass Methods + Bash Automation + Your Support ;)

karma_v2

⡷⠂𝚔𝚊𝚛𝚖𝚊 𝚟𝟸⠐⢾ is a Passive Open Source Intelligence (OSINT) Automated Reconnaissance (framework)

back-me-up

This tool will check for Sensitive Data Leakage with some useful patterns/RegEx. The patterns are mostly targeted on waybackdata and filter everything accordingly.

karma_v1

KARMA is a simple bash script automation that can hit Shodan Premium API and find active IPs, ASN, Common Vulnerabilities, CVEs & Open Ports.

notes

Bug Bounty & Other Stuff

subzzZ

SubzzZ to find possible subdomains using passive recon. Tool also support Permutations, Mutations, Alterations.

Prototype-Pollution-Lab_me_dheeraj

Prototype-Pollution-Lab to chain the vulnerabilities between multiple accounts.

Dheerajmadhukar

Director | Trainer at CDAC Under The Ministry of Electronics and Information | Corporate Trainer at Indian Air Force Under the Ministry of Defense ... Jai Hind

BB-Hunt-A-Day

A simple mind map with some automation/bash commands/tools execution. I hope it may help you all :)

GitApp

GITAPP : Tool will display all data URLs from GitHub including XML, JSON, Java, Text, Kotlin, Ruby, Markdown, CSV, Python, PHP, GO, YAML, Elixir, C++, JavaScript, HTML & many more . . .

Insecure-Comparison-Lab_me_dheeraj

Insecure Comparison in JavaScript. CTF written in nodejs Express module.

oh-my-dorks

community

fdns

To resolve IP/Domain to check the correct resolver.