mak-/scantastic-tool

It's bloody scantastic

scantastic-tool

It's bloody scantastic

If you like this and are feeling a bit(coin) generous - 1JdSGqg2zGTbpFMJPLbWoXg7Nng3z1Qp58

It works for me: http://makthepla.net/scantastichax.png

• Dependencies: (DIY - I ain't supportin shit)
• Masscan - https://github.com/robertdavidgraham/masscan
• Nmap - https://nmap.org/download.html
• ElasticSearch - http://www.elasticsearch.org/guide/en/elasticsearch/guide/current/_installing_elasticsearch.html
• Kibana - http://www.elasticsearch.org/overview/kibana/installation/

This tool can be used to store masscan or nmap data in elasticsearch, (the scantastic plugin in the image is not here)

It allows performs distributed directory brute-forcing.

All your base are belong to us. I might maintain or improve this over time. MIGHT.

Quickstart

Example usage

Run and import a scan of home /24 network

./scantastic.py -s -H 192.168.1.0/24 -p 80,443 -x homescan.xml (with masscan)
./scantastic.py -ns -H 192.168.1.0/24 -p 80,443 -x homescan.xml (with nmap)

Export homescan to a list of urls

./scantastic.py -eurl -x homescan.xml > urlist (with masscan)
./scantastic.py -nurl -x homescan.xml > urlist (with nmap)

Brute force the url list using wordlist and put results into index homescan using 10 threads (By default it uses 1 thread)

./scantastic.py -d -u urlist -w some_wordlist -i homescan -t 10

root@ubuntu:~/scantastic-tool# ./scantastic.py -h
usage: scantastic.py [-h] [-v] [-d] [-s] [-noes] [-sl] [-in] [-e] [-eurl]
                     [-del] [-H HOST] [-p PORTS] [-x XML] [-w WORDS] [-u URLS]
                     [-t THREADS] [-esh ESHOST] [-esp PORT] [-i INDEX]
                     [-a AGENT]

optional arguments:
  -h, --help            show this help message and exit
  -v, --version         Version information
  -d, --dirb            Run directory brute force. Requires --urls & --words
  -s, --scan            Run masscan on single range. Specify --host & --ports
                        & --xml
  -ns, --nmap           Run Nmap on a single range specify -H & -p
  -noes, --noelastics   Run scan without elasticsearch insertion
  -sl, --scanlist       Run masscan on a list of ranges. Requires --host &
                        --ports & --xml
  -nsl, --nmaplist      Run Nmap on a list of ranges -H & -p & -x
  -in, --noinsert       Perform a scan without inserting to elasticsearch
  -e, --export          Export a scan XML into elasticsearch. Requires --xml
  -eurl, --exporturl    Export urls to scan from XML file. Requires --xml
  -nurl, --exportnmap   Export urls from nmap XML, requires -x
  -del, --delete        Specify an index to delete.
  -H HOST, --host HOST  Scan this host or list of hosts
  -p PORTS, --ports PORTS
                        Specify ports in masscan format. (ie.0-1000 or
                        80,443...)
  -x XML, --xml XML     Specify an XML file to store output in
  -w WORDS, --words WORDS
                        Wordlist to be used with --dirb
  -u URLS, --urls URLS  List of Urls to be used with --dirb
  -t THREADS, --threads THREADS
                        Specify the number of threads to use.
  -esh ESHOST, --eshost ESHOST
                        Specify the elasticsearch host
  -esp PORT, --port PORT
                        Specify ElasticSearch port
  -i INDEX, --index INDEX
                        Specify the ElasticSearch index
  -a AGENT, --agent AGENT
                        Specify a User Agent for requests

Use -noes and -in scans to not import scans by default upon completion of a scan

scantastic-tool's Issues

Use requirements.txt

A requirements file is a list of packages to install and their versions.

This can be done with one command e.g:

pip install -r requirements.txt

Bit nicer than multiple pip installs and documentation reading.

Example requirements.txt:

MyApp
Framework==0.9.4
Library>=0.2

(PR might come later)

TypeError: string indices must be integers, not str

Reports the following during the start:

Starting masscan 1.0.3 (http://bit.ly/14GZzcT) at 2016-08-10 16:37:11 GMT
-- forced options: -sS -Pn -n --randomize-hosts -v --send-eth
Initiating SYN Stealth Scan
Scanning 1 hosts [15 ports/host]
xml/scan.xml: No such file or directory
xml/scan.xml: No such file or directory6 remaining, found=0
Scan completed!
IO Error
Traceback (most recent call last):
File "/scantastic-tool-master/scantastic.py", line 242, in
args.port, args.noinsert)
File "/scantastic-tool-master/scantastic.py", line 133, in scan
ms.import_es(index, eshost, esport)
File "/scantastic-tool-master/netscan.py", line 48, in import_es
port = entry['ports']['port']
TypeError: string indices must be integers, not str

Provide an automated environment

DIY for elasticsearch/logstash is OK but it would be easy/cool if a DockerFile/Vagrantfile was supplied for ease of use purposes just to give an configured elasticsearch server quickly on some local VM.

Use setup.py

It would be nice if you introduced a setup.py so we can install directly with pip and also add the tool onto pypi. Not sure what this means for your included resources.

(Might add a PR for this later)

OSError: [Errno 2] No such file or directory

I'm running on the El Captain Mac OS

$ python /Users/SSK/Desktop/Hacking/Tools/scantastic-tool-master/scantastic.py -s -H 127.0.0.1 -p 80,443 -x home.xml
Traceback (most recent call last):
File "/Users/SSK/Desktop/Hacking/Tools/scantastic-tool-master/scantastic.py", line 242, in
args.port, args.noinsert)
File "/Users/SSK/Desktop/Hacking/Tools/scantastic-tool-master/scantastic.py", line 131, in scan
ms.run()
File "/Users/SSK/Desktop/Hacking/Tools/scantastic-tool-master/netscan.py", line 23, in run
popen = subprocess.Popen(self.args, stdout=subprocess.PIPE)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/subprocess.py", line 710, in init
errread, errwrite)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/subprocess.py", line 1335, in _execute_child
raise child_exception
OSError: [Errno 2] No such file or directory

Is the config for the Panel available?

I've just discovered this tool. Nice! Good excuse for me to learn more ELK-foo. I'm wondering if the Panel config is available? Or am I missing something very simple here....?

I've also created a Dockerfile to set this all up which I will hopefully publish tonight.