kawaiipantsu / redjoust Goto Github PK

A quick and easy to use security reconnaissance webapp tool, does OSINT, analysis and red-teaming in both passive and active mode. Written in nodeJS and Electron.

Home Page: https://thugs.red

License: MIT License

CSS 43.20% JavaScript 44.71% HTML 11.36% PHP 0.59% Python 0.13%

hacking hacking-tool pentesting security security-tools reconnaissance analysis secops nodejs node-js electron electron-app fingerprinting scanning-tool devsecops sectools security-audit security-scanner security-scan security-testing

redjoust's Introduction

ᵔᴥᵔ RedJoust

A quick and easy to use security reconnaissance webapp tool, does OSINT, analysis and red-teaming in both passive and active mode. Written in nodeJS and Electron.

Join the community

Join the community of Kawaiipantsu / THUGS(red) and participate in the dev talk around Redjoust or simply just come visit us and chat about anything security related :) We love playing around with security. Also we have ctf events and small howto events for new players.

THUGS(red) Discord: https://discord.gg/Xg2jMdvss9

Its beginning to take shape !! I now have almost all internal logic in place, so i can now begin to develop a bit more on the actual intel gathering items.

Come back later :)

What it looks like (what i'm going for)

I have included 2 screenshots, i will update them regularly :)

First is just the main webapp default page where you can see i have set TARGEt and MODE and then relevent gather info items are shown and also target is parses and split out into other menu sections with each their own relevent gather info items!
Second is just other cases i wanted to show off, this is etc the Toolbox view of Base64

Status on whats done

Boiler plate layout done (How i want the app to look)
Support for Light / Dark OS theme
Styled scrollbar (Not using OS dependent functionality)
- Now working for menu sidebar and main window on overflow
User and system information
Fetching remote/public IP
Making sure its at least a bit secure
- webSecurity on
- devTools disabled (not doing development)
- nodeIntegration enabled
- contextIsolation enabled
- Privacy mode (enable shading the window for privacy)
Privacy/lock screen mode
Menu/File bar with shortcuts and icons
About window
Links to github, wiki (help) and issues
Make logic to set "mode" ie. passive or active
Figure out how i want my "modules" logic
Make "mode" logic, modules should follow this
Make modules to handle recon/analysis/red-team functions (dropped)
Deciding on storage/settings node module
Initiating default settings/config
Reading config settings
Getting "theme" from config settings, only dark/light/system supported
Storing config states from session to session (like mode/target)
Honing in how i want to run items/collecting data
Functional statusbar (text/icon)
Statusbar keeps track on running items
Silly idle quotes in statusbar (for play and show)
Added debug toggle in config settings (etc hiding all console.log)
New Preferences window (To etc change config settings values)
showpage func to provide easy page logic with not found also
Item click logic, able to do different things depending on state (ready, working, done)
Simple spin animation on some of the statusbar icon presets (looks fun)
Cleaned up renderer.js to keep it minimal and everything in preload stage
New "is done" logic, and tried to comment on how to make "items" for this
3 new menu sections, target ip, target hostname, target domain name will show on target selection
Reset functionallity to whipe slate clean so you can rerun jobs
Utilizing html data attributes to store item settings for easy implementation
Showing the config settings in preference window but just for show
New defaults scheme, no need for cutom defualtsettings writer function
Next page (goto next) continue logic, will itterate though mode, target and run if they are not set
Make default first page show easy 3 button layout - Set mode, set target, run
Default page done
Added target history, save last 50 targets for future options like autocomplete
Target history cleanup logic
Default item page layout/template
Add "safety" features as, toggle alerting if red-team mode is active
Make logic to set your target (ip, hostname or domain)
- setTarget()
  - Show/hide the propper menu sections
  - Should be able to be run onload as well
  - update global vars
  - update conf settings storage
  - Needs to parse/detect if its hostname or ip
  - Enable to find domain name from hostname
  - if ip generate ip subnet info
  - Read from pagetarget
Target page, history autocomplete
Added toggle for external tools menu
Added toggle for streamer-mode (just removes obvious things like public ip)
Preparing for more config settings
- default NS server to use (static or system)
Target logic done
updateItem visibility logic done
updateItem states logic done
Now able to set target via "enter" or "continue" on target page
Custom DNS NS server for resolver supported
- Supports system (use system default ns servers)
- Multiple custom via array
- Single custom via string
Make simple DNS lookup module ~~(json return)~~ to test output for page
Complete toolbox tool: Base64 convertion
Complete toolbox tool: Hashes (Live hashing)
External URL link in toolbox logic (Used for CyberChef etc)
Toolbox can be toggled show/hide via View menu
WHOIS function done, using proper sockets and talk to whois query services (OS independent)
Domain name WHOIS item done
IP address WHOIS item done
IP address WHOIS now supports own specific whois server based on ip-net
Fixed FQDN bug where etc www.amazon.co.uk would think the domain was co.uk :) (classic!)
Up to date whois server list in json format (updated via a php script by me so semi auto)
hostname / domainname / ip menu font-size now autoscales to fit!
New target logic
- if TARGET = IP ( Set IP + Reverse IP and set Hostname + Parse Hostname for Domainname and set )
- if TARGET = HOSTNAME ( Set Hostname + Parse Hostname for Domainname and set + Resolve IP for Hostname and set )
- if TARGET = DOMAINNAME ( Set Domainname + Resolve IP for Domainname and set + Reverse IP for Hostname and set )
Getting PowerMonitor to work, so i can attach to System OS idle/suspend events
Supports new "idle" mode, lockscreen for privacy when idle time is hit, unlocks when active again

TODO list (what i want to get done short term)

Way to find childs/processes of async things running
Make Preferences window useful
Preparing for more config settings
- proxy usage
- tor usage
- specific item options
proxy/tor/socks logic

redjoust's People

Contributors

Stargazers

Watchers

Forkers

optionalg tor-0 durbanspoison charinath 5l1v3r1 vaginessa lcsouzamenezes subzero4hk

redjoust's Issues

Target History (Max hist-target cleanup, wrong order)

When adding more than 50 (default) targets next time you start Redjoust it's supposed to clean up the history list of old targets.
Removing so there is only the last 50 targets saved. Obviously it should remove old-targets first :)

Behavior expected / Reproduce

Add "target 1"
Add 49 more
Add "target 51"
Expect on next startup that "target 1" is removed

Actual behavior

"target 51" is removed

Fix code scanning alert - DOM text reinterpreted as HTML

Tracking issue for:

https://github.com/kawaiipantsu/redjoust/security/code-scanning/3

Fingerprinting vendor verification strings

This might be a long "task" as it's ever growing. All fingerprints i find along the way will be added here and once added to the JSON file with regexp, descriptions and a title it can be checked as done for each one. This list does not include the already 25 fingerprints i have added. So please before adding new string here, check if it's already in the file by doing a:

Want to contribute ? This is the file we are working on:
https://github.com/kawaiipantsu/redjoust/blob/dev/assets/json/online-service-provider-fingerprint.json

The steps to help:
Basically the task is to choose a verification-string from below and then do the following research:

Figure out who it belongs to
Figure out the specific service/product it belongs to
Figure out the simplest regex to uniqliy identify it
- 1. a test regexp
- 1. a match regexp (that matches the hash/data)
Use the JSON template and add it to the file :)

JSON Template for new fingerprint

{
    "fingerprintName": "<short 40-70chars detailed output string for fingerprint>",
    "inCategoeries": [0],
    "serviceProvider": {
        "name": "<company name>",
        "desc": "<company short info>",
        "url": "<company/product link>"
    },
    "serviceHash": {
        "original": "<verification string as seen in the wild/from the task list)>",
        "comment": "",
        "regexp": {
            "test": "/^<regexp-test>/i",
            "match": "/^<regexp-match (.+)>/i"
        }
    }
}

# To list all known test strings
cat online-service-provider-fingerprint.json | jq '.knownFingerprints[].serviceHash.regexp.test'

# To search for a specific string
cat online-service-provider-fingerprint.json | jq '.knownFingerprints[].serviceHash.regexp.test' | grep "string"

Vendor verification strings seen in the wild

This is the list of evergrowing strings seen in the wild that i would love to be able to fingerprint :)
So digg in !!

Overall "Recon Items" list for needed startup passive,active and redteam items

Ths is the overall list that we want to fufill before releaseing the first beta test client of Redjoust.
We want a few items in each category before we start up. Please remember we have 3 target types and 3 item types.
So if we list it as seen from item types then you need to provide what target types it supports

PASSIVE items

For now we start with a total of 5 passive items showing

DNS Deep-Dive ( #23 )
- Show on domain target
- Show on host-name target
Certificate Transparency (CT) Lookup ( #24 )
- Show on domain target
Whois
- Show on domain target
- Show on IP target

ACTIVE items

For now we start with a total of 4 active items showing

Simple service detector (port-scanning)
- Build up overview of each target and save result for them
- Show on host-name target
- Show on domain target
HTTP/Web Digger
- Available if sub-target port 80,443 found in service results (Not sure how this will work)
- Show on host-name target
- Show on domain target

REDTEAM items

For now we start with a total of 1 redteam items showing

Web Fuzz (Simple)
- Available if sub-target port 80,443 found in service results (Not sure how this will work)
- Show on host-name target
- Show on domain target

Fix code scanning alert - DOM text reinterpreted as HTML

Tracking issue for:

https://github.com/kawaiipantsu/redjoust/security/code-scanning/2

Mem Usage wrong in monitor

The monitor that shows CPU and MEM usage is showing wrong numbers for mem used.

Will be solved in #34

Make a iknowwhatyoudownload.com item lookup

I know that iknowwhatyoudownload.com requires API, so i will instead build a crawler and parse the site live. This will no doubt mean more work and things fail when ever they change up their site :) But it also means that i can keep the application from the need to etc share an api key or that the "user" suddenly is responsible for getting an API key in order for that item-lookup to work.

This is still just a "nice to have" idea.
Would obviously be a "passive" item under "IP target".

DNS Deep dive - Host fuzz broken shows "failed" on all hosts even "found"

So when running the deep dive on a target where i know that one of the fuzz words should resolve they are all marked as failed.
I did change something previously about string sanitizing related to injection. Maybe i did something or changed something.

But now when it resolves it's not getting the correct classes set.
Therefore breaking the functionality.

Lookup '`target`' SOA

DNS Information Recon (Deep dive)

Item condition criteria: Target must be a host/domain name
Item gather type: Passive

This is the task/issue for creating the "DNS Information Recon" item, that does a deep dive into osint dns info etc.
I have made a list of things that i want it to do out of the box, its a lot but again it all depends on how it's shown.

Attached files

DNS-Token-Fingerprints.txt

Crackfoo.net look up toolbox item

We need to have a toolbox lookup item for crackfoo.net. The do have an api interface but to keep the app free of api key settings for every e terns service for now I would rather have we parsed the results directly on the sites.

Included is example in such solution

curl -sX POST "http://crackfoo.net/?algo=$2" -d "hash=$1&sa=Search" | grep SUCCESS | awk '{print$9":"$13 }'

Make a abuseipdb.com item lookup

I know that abuseipdb.com requires API, so i will instead build a crawler and parse the site live. This will no doubt mean more work and things fail when ever they change up their site :) But it also means that i can keep the application from the need to etc share an api key or that the "user" suddenly is responsible for getting an API key in order for that item-lookup to work.

This is still just a "nice to have" idea.
Would obviously be a "passive" item under "IP target".

Preferences windows (Make useful)

The current preferences window is not very useful, so far i have only made it so that it shows the users config file directly as it's loaded by the electron-storage module. We need to make the preferences page into an actual thing that can change the settings.

Task

It should be able to change all config options (that are use related)
Dynamically applied, no need for "apply/save"
Show what is default values
Extra things that might be cool
- Option to open config directly in editor for "advanced" operation
- Import / Export features

Certificate Transparency (CT) Searching/Lookup item

I need to construct the last passive item module i need for the first beta test release. Then i need to move on to the active items.
But for now we need a CT lookup item.

I will try to make it so that at least it's showing the same as my recon-ct script.

kawaiipantsu / redjoust Goto Github PK

redjoust's Introduction

ᵔᴥᵔ RedJoust

Join the community

What it looks like (what i'm going for)

Status on whats done

TODO list (what i want to get done short term)

redjoust's People

Contributors

Stargazers

Watchers

Forkers

redjoust's Issues

Fingerprinting vendor verification strings

Vendor verification strings seen in the wild

Overall "Recon Items" list for needed startup passive,active and redteam items

PASSIVE items

ACTIVE items

REDTEAM items

DNS Information Recon (Deep dive)

Attached files

Recommend Projects

Recommend Topics

Recommend Org