SN1PER – Most Advanced Automated Penetration Testing Tool – 2023

Sn1per is an automated scanner that can automate the process of collecting data for exploration and penetration testing.

In their work sn1per involves such well-known tools like: amap, arachni, amap, cisco-torch, dnsenum, enum4linux, golismero, hydra, metasploit-framework, nbtscan, nmap smtp-user-enum, sqlmap, sslscan, theharvester, w3af, wapiti, whatweb, whois, nikto, wpscan.d during a penetration test to enumerate and scan for vulnerabilities.

Table of Contents:

Features
Modes
Detailed Demonstration – sn1per
theHarvester
Sublist3r
wafw00f
XST
Nikto
INURLBR
MassBleed
Yasuo
BruteX

FEATURES:

• Automatically collects basic recon (ie. whois, ping, DNS, etc.)
• Automatically launches Google hacking queries against a target domain
• Automatically enumerates open ports
• Automatically brute forces sub-domains and DNS info
• Automatically checks for sub-domain hijacking
• Automatically runs targeted NMap scripts against open ports
• Automatically runs targeted Metasploit scan and exploit modules
• Automatically scans all web applications for common vulnerabilities
• Automatically brute forces all open services
• Automatically exploit remote hosts to gain remote shell access
• Performs high-level enumeration of multiple hosts
• Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
• Automatically integrates with Metasploit Pro, MSFConsole, and Zenmap for reporting
• Create individual workspaces to store all scan output

MODES:

• REPORT: Outputs all results to text in the loot directory for later reference. To enable reporting, append ‘report’ to any sniper mode or command.
• STEALTH: Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking
• DISCOVER: Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans.
• PORT: Scans a specific port for vulnerabilities. Reporting is not currently available in this mode.
• FULLPORTONLY: Performs a full detailed port scan and saves results to XML.
• WEB: Adds full automatic web application scans to the results (port 80/TCP & 443/TCP only). Ideal for web applications but may increase scan time significantly.
• NOBRUTE: Launches a full scan against a target host/domain without brute forcing services.
• AIRSTRIKE: Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, and IPs that need to be scanned, and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.
• NUKE: Launch full audit of multiple hosts specified in the text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke.
• LOOT: Automatically organizes and displays the loot folder in your browser and opens Metasploit Pro and Zenmap GUI with all port scan results. To run, type ‘sniper loot’.

Detailed Demonstration – sn1per

Step 1:

Download the  Sniper clone Repository from GitHub. Extract it Zip file in the Desktop

#git clone https://github.com/1N3/Sn1per.git

Step 2:

Install the sn1per using the install.sh file in sn1per folder .

#chmod +x install.sh

Step 3:

Install sn1per using this command.

#./install.sh

Step 4:

After successfully installing sn1per open the tool.

Step:5

After Successfully Open the Sn1per, Start Gathering the information from the Target

#sniper  facebook.com

Here you will get some information about the fingerprint of specific Target.

Domain name lookup service “who is information” to search the whois database for domain name registration information.

theHarvester

The objective of this program is to gather emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and the SHODAN computer database.

This tool is intended to help Penetration testers in the early stages of the penetration test in order to understand the customer footprint on the Internet. It is also useful for anyone that wants to know what an attacker can see about their organization.

Here you will get some information about the DNS Information specific Target.

Sublist3r

Sublist3r is a Python tool that is designed to enumerate subdomains of websites through OSINT.

It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.

Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing, Baidu, and Ask.

Sublist3r also enumerates subdomains using Netcraft, Virustotal, ThreatCrowd, DNSdumpster, and ReverseDNS.

wafw00f

Web Application firewalls are typically firewalls working on the application layer which monitors & modifies HTTP requests.

The key difference is that WAFs work on Layer 7 – Application Layer of the OSI Model. Basically, all WAFs protect against different HTTP attacks & queries like SQLi & XSS

Wafw00f is simply a Python tool that automates a set of procedures used in finding a WAF. Wafw00f simply queries a web server with a set of HTTP requests & methods. It analyses the responses from them & detects the firewall in place.

XST

the “XS” in XST evokes similarity to XSS (Cross-Site Scripting) which has the consequence of leading people to mistake XST as a method for injecting JavaScript.

Nikto

Running Nikto yourself is not overly difficult. you will be able to start your web server testing with one of the most well-known website/server testing tools.

This is the same tool we use on our online Nikto scanner page.

INURLBR

Advanced search in search engines, enables analysis provided to exploit GET / POST capturing emails & urls, with an internal custom validation junction for each target / url found.

MassBleed

MassBleed  is an SSL Vulnerability Scanner .main functions with the ability to proxy all connections:

• To mass scan any CIDR range for OpenSSL vulnerabilities via port 443/tcp (https) (example: sh massbleed.sh 192.168.0.0/16)
• To scan any CIDR range for OpenSSL vulnerabilities via any custom port specified (example: sh massbleed.sh 192.168.0.0/16 port 8443)
• To individually scan every port (1-10000) on a single system for vulnerable versions of OpenSSL (example: sh massbleed.sh 127.0.0.1 single)
• To scan every open port on every host in a single class C subnet for OpenSSL vulnerabilities (example: sh massbleed.sh 192.168.0. subnet)

Yasuo

Yasuo is a ruby script that scans for vulnerable 3rd-party web applications.

While working on a network security assessment (internal, external, redteam gigs etc.), we often come across vulnerable 3rd-party web applications or web front-ends that allow us to compromise the remote server by exploiting publicly known vulnerabilities.

Some of the common & favorite applications are Apache Tomcat administrative interface, JBoss jmx-console, Hudson Jenkins, and so on.

BruteX

Automatically brute force all services running on a target.

• Open ports
• DNS domains
• Usernames
• Passwords

so a collection of advanced information gathering and scanning tools are playing their role with Sn1per and Distributing the Exact information and scanning result from a specific target.

You can also learn the complete YouTube videos here for all the Sn1per pen-testing module training.

Also Read :

• Masscan-Worlds fastest scanner
• How to perform Information Gathering in Kali using NMAP – A Detailed Explanation
• Cisco-Torch -Mass scanning, Fingerprinting, and Exploitation tool
• Lynis – Open source security auditing tool – A Detailed Explanation
• HPING3 – Network Scanner -Packer Generator