maldevel/intelspy

Perform automated network reconnaissance scans

Perform automated network reconnaissance scans to gather network intelligence.

IntelSpy is a multi-threaded network intelligence tool which performs automated network services enumeration. It performs live hosts detection scans, port scans, services enumeration scans, web content scans, brute-forcing, detailed off-line exploits searches and more.

The tool will also launch further enumeration scans for each detected service using a number of different tools.

---

Features

• Scans multiple targets in the form of IP addresses, IP ranges (CIDR notation) and resolvable hostnames.
• Scans targets concurrently.
• Detects live hosts in an IP range (CIDR) network.
• Customizable port scanning profiles and service enumeration commands.
• Creates a directory structure for results gathering and reporting.
• Logs every command that was executed.
• Generates shell scripts containing commands to be run manually.
• Extracts important information in txt and markdown format for further inspection.
• Stores data to an SQLite database.
• Generates an HTML report.

---

Requirements

• Python 3 (sudo apt install python3)
• Linux (preferably Kali Linux or any other hacking distribution containing the tools below.)
  • https://www.kali.org/downloads/
• toml (https://github.com/toml-lang/toml)
• seclists (https://github.com/danielmiessler/SecLists)
• curl (prerequisite) (sudo apt install curl)
• enum4linux (prerequisite) (sudo apt install enum4linux)
• gobuster (prerequisite) (sudo apt install gobuster)
• hydra (optional) (sudo apt install hydra)
• ldapsearch (optional) (sudo apt install ldap-utils)
• medusa (optional) (sudo apt install medusa)
• nbtscan (prerequisite) (sudo apt install nbtscan)
• nikto (prerequisite) (sudo apt install nikto)
• nmap (prerequisite) (sudo apt install nmap)
• onesixtyone (prerequisite) (sudo apt install onesixtyone)
• oscanner (optional) (sudo apt install oscanner)
• pandoc (prerequisite) (sudo apt install pandoc)
• patator (optional) (sudo apt install patator)
• showmount (prerequisite) (sudo apt install nfs-common)
• smbclient (prerequisite) (sudo apt install smbclient)
• smbmap (prerequisite) (sudo apt install smbmap)
• smtp-user-enum (prerequisite) (sudo apt install smtp-user-enum)
• snmpwalk (prerequisite) (sudo apt install snmp)
• sslscan (prerequisite) (sudo apt install sslscan)
• svwar (prerequisite) (sudo apt install sipvicious)
• tnscmd10g (prerequisite) (sudo apt install tnscmd10g)
• whatweb (prerequisite) (sudo apt install whatweb)
• wkhtmltoimage (prerequisite) (sudo apt install wkhtmltopdf)
• wpscan (optional) (sudo apt install wpscan)

pip3 install -r requirements.txt

---

Usage

$ python3 intelspy.py -h

 ___               __        
  |  ._ _|_  _  | (_  ._     
 _|_ | | |_ (/_ | __) |_) \/ 
                      |   /  
                                
IntelSpy v2.0 - Perform automated network reconnaissance scans to gather network intelligence.
IntelSpy is an open source tool licensed under GPLv3.
Written by: @maldevel | Logisek ICT
Web: https://logisek.com | https://pentest-labs.com
Project: https://github.com/maldevel/intelspy


usage: intelspy.py [-h] [-ts TARGET_FILE] -p PROJECT_NAME -w WORKING_DIR
                   [--exclude <host1[,host2][,host3],...>] [-s SPEED]
                   [-ct <number>] [-cs <number>] [--profile PROFILE_NAME]
                   [--livehost-profile LIVEHOST_PROFILE_NAME]
                   [--heartbeat HEARTBEAT] [-v]
                   [targets [targets ...]]

positional arguments:
  targets               IP addresses (e.g. 10.0.0.1), CIDR notation (e.g.
                        10.0.0.1/24), or resolvable hostnames (e.g.
                        example.com) to scan.

optional arguments:
  -h, --help            show this help message and exit
  -ts TARGET_FILE, --targets TARGET_FILE
                        Read targets from file.
  -p PROJECT_NAME, --project-name PROJECT_NAME
                        project name
  -w WORKING_DIR, --working-dir WORKING_DIR
                        working directory
  --exclude <host1[,host2][,host3],...>
                        exclude hosts/networks
  -s SPEED, --speed SPEED
                        0-5, set timing template (higher is faster) (default:
                        4)
  -ct <number>, --concurrent-targets <number>
                        The maximum number of target hosts to scan
                        concurrently. Default: 5
  -cs <number>, --concurrent-scans <number>
                        The maximum number of scans to perform per target
                        host. Default: 10
  --profile PROFILE_NAME
                        The port scanning profile to use (defined in port-
                        scan-profiles.toml). Default: default
  --livehost-profile LIVEHOST_PROFILE_NAME
                        The live host scanning profile to use (defined in
                        live-host-scan-profiles.toml). Default: default
  --heartbeat HEARTBEAT
                        Specifies the heartbeat interval (in seconds) for task
                        status messages. Default: 60
  -v, --verbose         Enable verbose output. Repeat for more verbosity (-v,
                        -vv, -vvv).

---

Usage Examples

Scanning single target

sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ 192.168.10.15
sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ 192.168.10.15 -v
sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ 192.168.10.15 -vv
sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ 192.168.10.15 -vvv

Scanning a hostname

sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ example.com

Scanning a network range(CIDR)

sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ 192.168.10.0/24

Scanning multiple targets (comma separated)

sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ 192.168.10.15 192.168.10.0/24 example.com

Scanning targets from file

sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ -ts /home/user/targets.txt

Excluding one host

sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ --exclude 192.168.10.9 192.168.10.0/24

Excluding many hosts

sudo python3 intelspy.py -p MyProjectName -w /home/user/pt/projects/ --exclude 192.168.10.9,192.168.10.24 192.168.10.0/24

---

Credits

I started working on IntelSpy when I discovered AutoRecon. Instead of reinventing the wheel, IntelSpy is the result of merging IntelSpy with the best features of the AutoRecon to create a network reconnaissance tool suitable for Penetration Testing engagements.

---

intelspy's Issues

Long scan report lost after exception

Hi, just to share the following error:

[*] Task tcp/443/nikto on <ip address> finished successfully in 101 hours, 4 seconds
[*] Finished scanning target <ip address> in 101 hours, 39 seconds

concurrent.futures.process._RemoteTraceback:
"""
Traceback (most recent call last):
  File "/usr/lib/python3.8/concurrent/futures/process.py", line 239, in _process_worker
    r = call_item.fn(*call_item.args, **call_item.kwargs)
  File "intelspy.py", line 1328, in scan_host
    results = loop.run_until_complete(asyncio.gather(scan_services(loop, semaphore, target,
  File "/usr/lib/python3.8/asyncio/base_events.py", line 616, in run_until_complete
    return future.result()
  File "intelspy.py", line 998, in scan_services
    result = task.result()
  File "intelspy.py", line 437, in run_cmd
    results = await asyncio.gather(*output)
  File "intelspy.py", line 384, in read_stream
    imp = e('{target.address} - ' + p['description'] + '\n\n').strip()
KeyError: 'description'
"""

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "intelspy.py", line 1996, in <module>
    if future.result():
  File "/usr/lib/python3.8/concurrent/futures/_base.py", line 432, in result
    return self.__get_result()
  File "/usr/lib/python3.8/concurrent/futures/_base.py", line 388, in __get_result
    raise self._exception
KeyError: 'description'

The problem is since intelspy save the entire report at the end of all scans, if you reach this error (or another) you lost all your progress (in my case ~100hs of scan), it would be great if intelspy save one report after each scan...

Thanks a lot

https is not handled

Hi,
When a target offers both http and https protocols only http scan is taking place. https is completely ignored.

Program do not check for target file option -ts

Dear Maldevel,

There is logic problem in conditional statement, while using -ts flag.
It breaks teh loop causing not to verify the file provide with -ts, because of "err set to true"

can you just comment the statement and realign the loop, so that if singel target is not mentioned, the program checks for the
fiel path mentioned in -ts arg.

Line no.1894

if len(raw_targets) == 0:
    error('You must specify at least one target to scan!')

err = True

if len(args.target_file) > 0:

    if not os.path.isfile(args.target_file):
        error('The target file {args.target_file} was not found.')
        sys.exit(1)

more features

hello

nice tool and great effort

would like to suggest more feature i think its important too to make the tool to be all in one

1- adding parameter discover using tools ParamSpider and arjun

2- adding Nuclei

3- adding gau

4- adding https://github.com/1ndianl33t/Gf-Patterns and more gf profiles

5- adding https://github.com/hakluke/hakrawler

6- adding Aquatone

7- addming amass