Friday, May 24, 2024

SN1PER – Most Advanced Automated Penetration Testing Tool – 2023

Sn1per is an automated scanner that can automate the process of collecting data for exploration and penetration testing.

In their work sn1per involves such well-known tools like: amap, arachni, amap, cisco-torch, dnsenum, enum4linux, golismero, hydra, metasploit-framework, nbtscan, nmap smtp-user-enum, sqlmap, sslscan, theharvester, w3af, wapiti, whatweb, whois, nikto, wpscan.d during a penetration test to enumerate and scan for vulnerabilities.

Table of Contents:

Detailed Demonstration – sn1per


  • Automatically collects basic recon (ie. whois, ping, DNS, etc.)
  • Automatically launches Google hacking queries against a target domain
  • Automatically enumerates open ports
  • Automatically brute forces sub-domains and DNS info
  • Automatically checks for sub-domain hijacking
  • Automatically runs targeted NMap scripts against open ports
  • Automatically runs targeted Metasploit scan and exploit modules
  • Automatically scans all web applications for common vulnerabilities
  • Automatically brute forces all open services
  • Automatically exploit remote hosts to gain remote shell access
  • Performs high-level enumeration of multiple hosts
  • Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
  • Automatically integrates with Metasploit Pro, MSFConsole, and Zenmap for reporting
  • Create individual workspaces to store all scan output


  • REPORT: Outputs all results to text in the loot directory for later reference. To enable reporting, append ‘report’ to any sniper mode or command.
  • STEALTH: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking
  • DISCOVER: Parses all hosts on a subnet/CIDR (ie. and initiates a sniper scan against each host. Useful for internal network scans.
  • PORT: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode.
  • FULLPORTONLY: Performs a full detailed port scan and saves results to XML.
  • WEB: Adds full automatic web application scans to the results (port 80/TCP & 443/TCP only). Ideal for web applications but may increase scan time significantly.
  • NOBRUTE: Launches a full scan against a target host/domain without brute forcing services.
  • AIRSTRIKE: Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, and IPs that need to be scanned, and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.
  • NUKE: Launch full audit of multiple hosts specified in the text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke.
  • LOOT: Automatically organizes and displays the loot folder in your browser and opens Metasploit Pro and Zenmap GUI with all port scan results. To run, type ‘sniper loot’.

Detailed Demonstration – sn1per

Step 1:

Download the  Sniper clone Repository from GitHub. Extract it Zip file in the Desktop

#git clone

Step 2:

Install the sn1per using the file in sn1per folder .

#chmod +x

Step 3:

Install sn1per using this command.


Step 4:

After successfully installing sn1per open the tool.


After Successfully Open the Sn1per, Start Gathering the information from the Target


Here you will get some information about the fingerprint of specific Target.

Domain name lookup service “who is information” to search the whois database for domain name registration information.


The objective of this program is to gather emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and the SHODAN computer database.

This tool is intended to help Penetration testers in the early stages of the penetration test in order to understand the customer footprint on the Internet. It is also useful for anyone that wants to know what an attacker can see about their organization.

Here you will get some information about the DNS Information specific Target.


Sublist3r is a Python tool that is designed to enumerate subdomains of websites through OSINT.

It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.

Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing, Baidu, and Ask.

Sublist3r also enumerates subdomains using Netcraft, Virustotal, ThreatCrowd, DNSdumpster, and ReverseDNS.


Web Application firewalls are typically firewalls working on the application layer which monitors & modifies HTTP requests.

The key difference is that WAFs work on Layer 7 – Application Layer of the OSI Model. Basically, all WAFs protect against different HTTP attacks & queries like SQLi & XSS

Wafw00f is simply a Python tool that automates a set of procedures used in finding a WAF. Wafw00f simply queries a web server with a set of HTTP requests & methods. It analyses the responses from them & detects the firewall in place.


the “XS” in XST evokes similarity to XSS (Cross-Site Scripting) which has the consequence of leading people to mistake XST as a method for injecting JavaScript.


Running Nikto yourself is not overly difficult. you will be able to start your web server testing with one of the most well-known website/server testing tools.

This is the same tool we use on our online Nikto scanner page.


Advanced search in search engines, enables analysis provided to exploit GET / POST capturing emails & urls, with an internal custom validation junction for each target / url found.


MassBleed  is an SSL Vulnerability Scanner .main functions with the ability to proxy all connections:

  • To mass scan any CIDR range for OpenSSL vulnerabilities via port 443/tcp (https) (example: sh
  • To scan any CIDR range for OpenSSL vulnerabilities via any custom port specified (example: sh port 8443)
  • To individually scan every port (1-10000) on a single system for vulnerable versions of OpenSSL (example: sh single)
  • To scan every open port on every host in a single class C subnet for OpenSSL vulnerabilities (example: sh 192.168.0. subnet)


Yasuo is a ruby script that scans for vulnerable 3rd-party web applications.

While working on a network security assessment (internal, external, redteam gigs etc.), we often come across vulnerable 3rd-party web applications or web front-ends that allow us to compromise the remote server by exploiting publicly known vulnerabilities.

Some of the common & favorite applications are Apache Tomcat administrative interface, JBoss jmx-console, Hudson Jenkins, and so on.


Automatically brute force all services running on a target.

  • Open ports
  • DNS domains
  • Usernames
  • Passwords

so a collection of advanced information gathering and scanning tools are playing their role with Sn1per and Distributing the Exact information and scanning result from a specific target.

You can also learn the complete YouTube videos here for all the Sn1per pen-testing module training.

Also Read :


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles