bitthebyte / monitorizer Goto Github PK

View Code? Open in Web Editor NEW

246.0 11.0 47.0 174.52 MB

Monitoring framework to detect and report newly found subdomains on a specific target using various scanning tools

Python 88.41% Dockerfile 2.23% Jinja 2.88% HTML 4.77% Shell 1.70%

bugbounty bugcrowd hackerone subdomain-enumeration subfinder

monitorizer's Introduction

Monitorizer

The Ultimate Subdomain Monitoring Framework

Installation

❗ Disclaimer
Admin users are able to execute code on the local server make sure to change the default password at otherwise use it at your own risk

Using docker

$ curl https://raw.githubusercontent.com/BitTheByte/Monitorizer/main/docker-compose.yml | docker compose -f - up

Default Credentials:

Once everything is ready you will be able to login to the dashboard at http://127.0.0.1:8000/dashboard/

Username	Email	Password
admin	[email protected]	P@ssW0rd

Features

Dark-Light Mode

Scalable

Monitorizer fully designed to run on large scale and handle thousands of distributed operations effortlessly

Events

Monitorizer supports various reporting channels to ensure you're always informed.

Telegram: Updates and alerts are directly sent to your specified Telegram channel, allowing for instant notifications and immediate team collaboration.

Webhook: Receive detailed reports and alerts through your webhook server to keep you aligned.

Extendable

Employ a zero-code strategy to integrate your own tools for domain enumeration and discovery effortlessly. Customize and extend functionalities without writing any new code.

Advanced Search

Utilize the dashboard to conduct comprehensive searches across all Monitorizer assets. This feature allows for quick location of necessary data points, streamlined through an intuitive search interface.

Import-Export

Utilize the dashboard to import and export assets easily

monitorizer's People

Contributors

Stargazers

Watchers

Forkers

secfathy pharaoh-hack 1337in mohammed-sec2010 prosecurity bbhunter xiaolushuo rapidsafeguard pedoatomico natrix-fork 5l1v3r1 kodjob g33kyshivam polling-repo-continua itsmenaga kiss404 olivierh59500 clicknull doanhnhq-uit leo-ryu manlio-tapia tubbz-alt bigbrobro slooppe sashka3076 sleepyeinstein m4xx101 conanjun ananan haxormad xelkomy s2b1n0 afwu excloudx6 attacker-codeninja maxdha peff1235 ratlesv r00x-dev demon1a totoro2205 ramosslyz arabhunters jeffmartson ktaranov trek0852 redbeard-92

monitorizer's Issues

[Improvement] Amass & Slack

Hi,
First of all, thanks for your tool, it's really cool but I think it could be even better, including adding a newer version of Amass and allowing users to add their API keys to the Amass configuration file because some APIs are not present in particular SecurityTrails which is an excellent source of domain.

I did a test on my side by modifying the current binary by the 3.5.1 version, I adding the file amass.ini to the config folder and I changed the amass line in default.json to :

"amass":{
                "cmd": "./ext/amass/amass enum -active -brute -min-for-recursive 1 -d {target} -config {amass_config} -o {output} -w {alts_wordlist}",
                "formats":{
                        "wordlist":"wordlists/namelist.txt",
                        "alts_wordlist":"wordlists/alterations.txt",
                        "amass_config":"config/amass.ini"
                }
        },

It is therefore also necessary to add the Amass config file and update the Readme to specify that it is more interesting to modify the amass config file with its API keys.

And by modifying the token requested for slack by the new version (this version will be outdated on May 5th)

If it's okay with you, I can handle doing PR for the Amass part.

Regards,
Jomar

[Feature Request] Add Httpx to thirdparties

Hi , Please can you add httpx with it options like [title, status-code, web-server -cname]
thanks in advance for this awesome tool

[Feature Request] Check for subdomain takeover

Summary

Add a new module to check for subdomain takeover(s)

Roadmap:

Use subjack's fingerprint https://github.com/haccer/subjack/blob/master/fingerprints.json to detect for common subdomain takeover messages

Concerns:

Is it possible to decrease the false-positive ratio to 0%?
- Maybe use something like an API? idk.
Scan for all discovered domains or just the new ones?
- Scanning all domains will increase the time required to finish the scan. The real impact will show up after > 10,000 domains found. since this tool is made to be kept running 24/7 this is a critical subject
- Scanning only discovered domains will not have a %100 coverage

error reported to the channel slack

Slack API TesterAPP 10:34 AM
FATAL ERROR: [Errno 2] No such file or directory: 'temp/test.com_subfinder.txt'

Is this project still maintained ?

Hey.

As the last commit was on July 2021, I wanted to reach out to know if there is interesting on keeping this project updated, or any plans for the future. Thanks a lot.

Traceback errro

Hi, when i run the command the following error is displayed

Traceback (most recent call last):
File "monitor.py", line 5, in
from events.on import Events
File "/root/Monitorizer/events/on.py", line 3, in
from core.report import Report
File "/root/Monitorizer/core/report.py", line 2, in
from .acunetix import Acunetix
File "/root/Monitorizer/core/acunetix.py", line 64
raise AXException("JSON_PARSING_ERROR", f"Json Parsing has occured: {e}")

thanks

[Feature Request] Add custom header to Nuclei Scan

Hi, Could you please add option to add a custom header to perform the nuclei scan, So all nuclei requests will have header like below ( nuclei has -H header for this )

X-Header: Bug-Bounty-test

Thanks for creating this awesome tool.

bot command doesnt add other tlds

Hi,

when i try to add a domina to the watch list , the add command doesn't add tld's with cl, ie anydomain.cl doenst add.