• Stars
    star
    5,000
  • Rank 8,000 (Top 0.2 %)
  • Language
    Go
  • License
    MIT License
  • Created over 5 years ago
  • Updated 3 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A Workflow Engine for Offensive Security

Osmedeus Core Engine

Osmedeus
Osmedeus - A Workflow Engine for Offensive Security


πŸ”₯ What is Osmedeus?

Osmedeus is a Workflow Engine for Offensive Security. It was designed to build a foundation with the capability and flexibility that allows you to build your own reconnaissance system and run it on a large number of targets.

πŸ“– Documentation & FAQ

You can check out the documentation at docs.osmedeus.org and the Frequently Asked Questions at here for more information.

πŸ“¦ Installation

NOTE that you need some essential tools like curl, wget, git, zip and login as root to start

bash <(curl -fsSL https://raw.githubusercontent.com/osmedeus/osmedeus-base/master/install.sh)

Build the engine from the source

Make sure you installed golang >= v1.17

go install -v github.com/j3ssie/osmedeus@latest

Check out this page for more the install on other platforms and docker image.

πŸš€ Key Features of Osmedeus

  • Significantly speed up your recon process
  • Organize your scan results
  • Efficiently to customize and optimize your recon process
  • Seamlessly integrate with new public and private tools
  • Easy to scale across large number of targets
  • Easy to synchronize the results across many places

πŸ’‘ Usage

# Example Scan Commands:
  ## Start a simple scan with default 'general' flow
  osmedeus scan -t sample.com

  ## Start a general scan but exclude some of the module
  osmedeus scan -t sample.com -x screenshot -x spider

  ## Start a scan directly with a module with inputs as a list of http domains like this https://sub.example.com
  osmedeus scan -m content-discovery -t http-file.txt

  ## Initiate the scan using a speed option other than the default setting
  osmedeus scan -f vuln --tactic gently -t sample.com
  osmedeus scan --threads-hold=10 -t sample.com
  osmedeus scan -B 5 -t sample.com

  ## Start a simple scan with other flow
  osmedeus scan -f vuln -t sample.com
  osmedeus scan -f extensive -t sample.com -t another.com
  osmedeus scan -f urls -t list-of-urls.txt

  ## Scan list of targets
  osmedeus scan -T list_of_targets.txt
  osmedeus scan -f vuln -T list-of-targets.txt

  ## Performing static vulnerability scan and secret scan on a git repo
  osmedeus scan -m repo-scan -t https://github.com/j3ssie/sample-repo
  osmedeus scan -m repo-scan -t /tmp/source-code-folder
  osmedeus scan -m repo-scan -T list-of-repo.txt

  ## Scan for CIDR with file contains CIDR with the format '1.2.3.4/24'
  osmedeus scan -f cidr -t list-of-ciders.txt
  osmedeus scan -f cidr -t '1.2.3.4/24' # this will auto convert the single input to the file and run

  ## Directly run on vuln scan and directory scan on list of domains
  osmedeus scan -f domains -t list-of-domains.txt
  osmedeus scan -f vuln-and-dirb -t list-of-domains.txt

  ## Use a custom wordlist
  osmedeus scan -t sample.com -p 'wordlists={{Data}}/wordlists/content/big.txt'

  ## Use a custom wordlist
  cat list_of_targets.txt | osmedeus scan -c 2

  ## Start a normal scan and backup entire workflow folder to the backup folder
  osmedeus scan --backup -f domains -t list-of-subdomains.txt

  ## Start the scan with chunk inputs to review the output way more much faster
  osmedeus scan --chunk --chunk-parts 20 -f cidr -t list-of-100-cidr.txt

  ## Continuously run the scan on a target right after it finished
  osmedeus utils cron --for --cmd 'osmedeus scan -t example.com'

  ## Backing up all workspaces
  ls ~/workspaces-osmedeus | osmedeus report compress


# Scan Usage:
  osmedeus scan -f [flowName] -t [target]
  osmedeus scan -m [modulePath] -T [targetsFile]
  osmedeus scan -f /path/to/flow.yaml -t [target]
  osmedeus scan -m /path/to/module.yaml -t [target] --params 'port=9200'
  osmedeus scan -m /path/to/module.yaml -t [target] -l /tmp/log.log
  osmedeus scan --tactic aggressive -m module -t [target]
  cat targets | osmedeus scan -f sample

# Practical Scan Usage:
  osmedeus scan -T list_of_targets.txt -W custom_workspaces
  osmedeus scan -t target.com -w workspace_name --debug
  osmedeus scan -f general -t sample.com
  osmedeus scan --tactic aggressive -f general -t sample.com
  osmedeus scan -f extensive -t sample.com -t another.com
  cat list_of_urls.txt | osmedeus scan -f urls
  osmedeus scan --threads-hold=15 -f cidr -t 1.2.3.4/24
  osmedeus scan -m ~/.osmedeus/core/workflow/test/dirbscan.yaml -t list_of_urls.txt
  osmedeus scan --wfFolder ~/custom-workflow/ -f your-custom-workflow -t list_of_urls.txt
  osmedeus scan --chunk --chunk-part 40 -c 2 -f cidr -t list-of-cidr.txt

πŸ’‘ For full help message, please run: osmedeus --hh or osmedeus scan --hh
πŸ“– Documentation can be found here: https://docs.osmedeus.org

Check out this page for full usage and the Practical Usage to see how to use Osmedeus in a practical way.

πŸ’¬ Community & Discussion

Join Our Discord server here

πŸ’Ž Donation & Sponsor

Osmedeus

Check out for a couple of donation methods here to get a premium package

License

Osmedeus is made with β™₯ by @j3ssiejjj and it is released under the MIT license.

More Repositories

1

metabigor

OSINT tools and more but without API ke
Go
1,113
star
2

IPOsint

⚠️WARNING: This project now become part of https://github.com/j3ssie/Metabigor project
Python
178
star
3

goverview

goverview - Get an overview of the list of URLs
Go
142
star
4

sdlookup

IP Lookups for Open Ports and Vulnerabilities from internetdb.shodan.io
Go
112
star
5

codeql-docker

Ready to use docker image for CodeQL
Python
84
star
6

go-auxs

Collection of auxiliary command line tools
Go
70
star
7

cdnstrip

Striping CDN IPs from a list of IP Addresses
Go
70
star
8

custom-bcheck-scan

This repository stores some of my custom BCheck Scan configurations. Its goal is to identify intriguing elements that warrant further manual testing.
60
star
9

c2s

Command and Control server on Slack
Python
26
star
10

str-replace

Simple tools to handle string and generate subdomain permutations
Go
13
star
11

cinfo

Extract domain from SSL Information
Go
12
star
12

sfleet

Simple utility to manage multiple ssh
Go
11
star
13

rgf

A wrapper around ripgrep to check for various common patterns.
Go
10
star
14

curated-semgrep-rules

Curated Collection of Popular Community Rules for Semgrep
Solidity
7
star
15

json-cleaner

The utility aims to clean up output generated by popular tools by calculating a hash based on specific JSON values to removing junk data.
Go
7
star
16

jig

Jig - Jaeles Intput Generator
Go
5
star
17

osm-demo

Osmedeus demo workflow
4
star
18

jLog

Really simple PHP script to log everything
PHP
4
star
19

phpsec-docker

Dockerfile
3
star
20

jIRC

Simple way to control your bot net via IRC
Python
3
star
21

j3ssie

2
star
22

really-sample

really-sample-projects
HTML
2
star
23

j3ssie.github.io

HTML
1
star
24

durl

Remove duplicate URLs by retaining only the unique combinations of hostname, path, and parameter names
Go
1
star
25

sample-semgrep-ci

Github Action Example with Semgrep SAST
Go
1
star