WebCopilot
An automation tool that enumerate subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.
Features โข Installation โข Usage โข WebCopilot โข Tools Used โข Acknowledgement
WebCopilot is an automation tool designed to enumerate subdomains of the target and detect bugs using different open-source tools.
The script first enumerate all the subdomains of the given target domain using assetfinder, sublister, subfinder, amass, findomain, hackertarget, riddler and crt then do active subdomain enumeration using gobuster from SecLists wordlist then filters out all the live subdomains using dnsx then it extract titles of the subdomains using httpx & scans for subdomain takeover using subjack. Then it uses gauplus & waybackurls to crawl all the endpoints of the given subdomains then it use gf patterns to filters out xss, lfi, ssrf, sqli, open redirect & rce parameters from that given subdomains, and then it scans for vulnerabilities on the subdomains using different open-source tools (like kxss, dalfox, openredirex, nuclei, etc). Then it'll print out the result of the scan and save all the output in a specified directory.
Features
- Subdomain Enumeration using assetfinder, sublist3r, subfinder, amass, findomain, etc.
- Active Subdomain Enumeration using gobuster & amass from SecLists/DNS wordlist.
- Extract titles and take screenshots of live subdoamins using aquatone & httpx.
- Crawl all the endpoints of the subdomains using waybackurls & gauplus and filter out XSS, SQLi, SSRF, etc parameters using gf patterns.
- Run different open-source tools (like dalfox, nuclei, sqlmap, etc) to search for vulnerabilities on these parameters and then save all the outputs in the folder.
Usage
g!2m0:~ webcopilot -h
โโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโฌโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโฆโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโฆโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[โ] @h4r5h1t.hrs | G!2m0
Usage:
webcopilot -d <target>
webcopilot -d <target> -s
webcopilot [-d target] [-o output destination] [-t threads] [-b blind server URL] [-x exclude domains]
Flags:
-d Add your target [Requried]
-o To save outputs in folder [Default: domain.com]
-t Number of threads [Default: 100]
-b Add your server for BXSS [Default: False]
-x Exclude out of scope domains [Default: False]
-s Run only Subdomain Enumeration [Default: False]
-h Show this help message
Example: webcopilot -d domain.com -o domain -t 333 -x exclude.txt -b testServer.xss
Use https://xsshunter.com/ or https://interact.projectdiscovery.io/ to get your server
Installing WebCopilot
WebCopilot requires git to install successfully. Run the following command as a root to install webcopilot
git clone https://github.com/h4r5h1t/webcopilot && cd webcopilot/ && chmod +x webcopilot install.sh && mv webcopilot /usr/bin/ && ./install.sh
Tools Used:
SubFinder โข Sublist3r โข Findomain โข gf โข OpenRedireX โข dnsx โข sqlmap โข gobuster โข assetfinder โข httpx โข kxss โข qsreplace โข Nuclei โข dalfox โข anew โข jq โข aquatone โข urldedupe โข Amass โข gauplus โข waybackurls โข crlfuzz
Running WebCopilot
To run the tool on a target, just use the following command.
g!2m0:~ webcopilot -d bugcrowd.com
The -o
command can be used to specify an output dir.
g!2m0:~ webcopilot -d bugcrowd.com -o bugcrowd
The -s
command can be used for only subdomain enumerations (Active + Passive and also get title & screenshots).
g!2m0:~ webcopilot -d bugcrowd.com -o bugcrowd -s
The -t
command can be used to add thrads to your scan for faster result.
g!2m0:~ webcopilot -d bugcrowd.com -o bugcrowd -t 333
The -b
command can be used for blind xss (OOB), you can get your server from xsshunter or interact
g!2m0:~ webcopilot -d bugcrowd.com -o bugcrowd -t 333 -b testServer.xss
The -x
command can be used to exclude out of scope domains.
g!2m0:~ echo out.bugcrowd.com > excludeDomain.txt
g!2m0:~ webcopilot -d bugcrowd.com -o bugcrowd -t 333 -x excludeDomain.txt -b testServer.xss
Example
Default options looks like this:
g!2m0:~ webcopilot -d bugcrowd.com - bugcrowd
โโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโฌโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโฆโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโฆโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
[โ] @h4r5h1t.hrs | G!2m0
[โ] Warning: Use with caution. You are responsible for your own actions.
[โ] Developers assume no liability and are not responsible for any misuse or damage cause by this tool.
Target: bugcrowd.com
Output: /home/gizmo/targets/bugcrowd
Threads: 100
Server: False
Exclude: False
Mode: Running all Enumeration
Time: 30-08-2021 15:10:00
[!] Please wait while scanning...
[โ] Subdoamin Scanning is in progress: Scanning subdomains of bugcrowd.com
[โ] Subdoamin Scanned - [assetfinderโ] Subdomain Found: 34
[โ] Subdoamin Scanned - [sublist3rโ] Subdomain Found: 29
[โ] Subdoamin Scanned - [subfinderโ] Subdomain Found: 54
[โ] Subdoamin Scanned - [amassโ] Subdomain Found: 43
[โ] Subdoamin Scanned - [findomainโ] Subdomain Found: 27
[โ] Active Subdoamin Scanning is in progress:
[!] Please be patient. This may take a while...
[โ] Active Subdoamin Scanned - [gobusterโ] Subdomain Found: 11
[โ] Active Subdoamin Scanned - [amassโ] Subdomain Found: 0
[โ] Subdomain Scanning: Filtering out of scope subdomains
[โ] Subdomain Scanning: Filtering Alive subdomains
[โ] Subdomain Scanning: Getting titles of valid subdomains
[โ] Visual inspection of Subdoamins is completed. Check: /subdomains/aquatone/
[โ] Scanning Completed for Subdomains of bugcrowd.com Total: 43 | Alive: 30
[โ] Endpoints Scanning Completed for Subdomains of bugcrowd.com Total: 11032
[โ] Vulnerabilities Scanning is in progress: Getting all vulnerabilities of bugcrowd.com
[โ] Vulnerabilities Scanned - [XSSโ] Found: 0
[โ] Vulnerabilities Scanned - [SQLiโ] Found: 0
[โ] Vulnerabilities Scanned - [LFIโ] Found: 0
[โ] Vulnerabilities Scanned - [CRLFโ] Found: 0
[โ] Vulnerabilities Scanned - [SSRFโ] Found: 0
[โ] Vulnerabilities Scanned - [Sensitive Dataโ] Found: 0
[โ] Vulnerabilities Scanned - [Open redirectโ] Found: 0
[โ] Vulnerabilities Scanned - [Subdomain Takeoverโ] Found: 0
[โ] Vulnerabilities Scanned - [Nuclieโ] Found: 0
[โ] Vulnerabilities Scanning Completed for Subdomains of bugcrowd.com Check: /vulnerabilities/
โโโโโ โโโ โโโ โโโโ โโโ โโโโโ
โโโโโ โโโ โโโ โโโโ โโโ โโโโโ
โโโโโ โโโ โโโ โโโโ โโโ โโโโโ
[+] Subdomains of bugcrowd.com
[+] Subdomains Found: 0
[+] Subdomains Alive: 0
[+] Endpoints: 11032
[+] XSS: 0
[+] SQLi: 0
[+] Open Redirect: 0
[+] SSRF: 0
[+] CRLF: 0
[+] LFI: 0
[+] Sensitive Data: 0
[+] Subdomain Takeover: 0
[+] Nuclei: 0
Acknowledgement
WebCopilot is inspired from Garud & Pinaak by ROX4R.
Thanks to the authors of the tools & wordlists used in this script.
@aboul3la @tomnomnom @lc @hahwul @projectdiscovery @maurosoria @shelld3v @devanshbatham @michenriksen @defparam @projectdiscovery @bp0lr @ameenmaali @sqlmapproject @dwisiswant0 @OWASP @OJ @Findomain @danielmiessler @1ndianl33t @ROX4R
Warning: Developers assume no liability and are not responsible for any misuse or damage cause by this tool. So, please se with caution because you are responsible for your own actions. |