RobinHood

Bug Hunting Recon Automation Script

This script performs automated recon on a target domain (large scope) by running the best set of tools to perform scanning and massive reconnaissance.

Required Tools (you need to install those by yourself)

• SUBFINDER (https://github.com/projectdiscovery/subfinder)

• AMASS (https://github.com/OWASP/Amass)

• SUBLIST3R (https://github.com/aboul3la/Sublist3r)

• HTTPX (https://github.com/projectdiscovery/httpx)

• GF (https://github.com/1ndianl33t/Gf-Patterns)

• GAU (https://github.com/lc/gau)

• QSREPLACE (https://github.com/tomnomnom/qsreplace)

• ANEW (https://github.com/tomnomnom/anew)

• URO (https://github.com/s0md3v/uro)

• SUBJACK (https://github.com/haccer/subjack)

• GOWITNESS (https://github.com/sensepost/gowitness)

• JSUBFINDER (https://github.com/ThreatUnkown/jsubfinder)

• DIRSEARCH (https://github.com/maurosoria/dirsearch)

• SQLMAP (https://github.com/sqlmapproject/sqlmap)

• ORALYZER (https://github.com/r0075h3ll/Oralyzer)

• NUCLEI (https://github.com/projectdiscovery/nuclei)

• NMAP (https://github.com/nmap/nmap)

• SMUGGLER (https://github.com/defparam/smuggler)

• CRLFUZZ (https://github.com/dwisiswant0/crlfuzz)

• CLOUDFLAIR (https://github.com/christophetd/CloudFlair)

• SCIPAG VULSCAN NSE (https://github.com/scipag/vulscan)

• SUBJS (https://github.com/lc/subjs)

• LINKFINDER (https://github.com/GerbenJavado/LinkFinder)

• VHOSTS SIEVE (https://github.com/dariusztytko/vhosts-sieve)

• CLOUD ENUM (https://github.com/initstring/cloud_enum)

• DALFOX (https://github.com/hahwul/dalfox)

• ALTDNS (https://github.com/infosec-au/altdns)

• DNSREAPER (https://github.com/punk-security/dnsReaper)

• FFUF (https://github.com/ffuf/ffuf)

• PARAMSPIDER (https://github.com/devanshbatham/ParamSpider)

• ARJUN (https://github.com/s0md3v/Arjun)

• KATANA (https://github.com/projectdiscovery/katana)

• LOG4J SCAN (https://github.com/fullhunt/log4j-scan)

EXAMPLES OF API AND TOOLS LOCATIONS

If you don't set those variables the related tools will not run!

FINGERPRINTS="" # Subjack fingerprints location

CLOUDFLAIR="" # CloudFlair tool location

CENSYS_API_ID="" # Censys api id for CloudFlair

CENSYS_API_SECRET="" # Censys api secret for CloudFlair

VULSCAN_NMAP_NSE="" # Vulscan NSE script for Nmap

JSUBFINDER_SIGN="" # Signature location for jsubfinder tool

LINKFINDER="" # Path for LinkFinder tool

VHOSTS_SIEVE="" # Path for VHosts Sieve tool

CLOUD_ENUM="" # Path for cloud_enum, Multi-cloud OSINT

SUBLIST3R="" # Path for sublist3r tool

ALTDNS_WORDS="" # Path to altdns words permutations file

DNSREAPER="" # Path to dnsrepaer tool

ORALYZER="" # Oralyzer path url tool

ORALYZER_PAYLOADS="" # Oralyzer payloads file

SMUGGLER="" # Smuggler tool

PARAMS="" # List of params for bruteforcing GET/POST hidden params

LFI_PAYLOADS="" # List of payloads for LFI

PARAMSPIDER="" # Path to paramspider tool

DIRSEARCH="" # Path to dirsearch tool

DIRSEARCH_WORDLIST="" # Path to dirsearch wordlist

LOG4JSCAN="" # Path do log4jscan tool

HEADERS_LOG4J="" # Path to log4j headers

Features

• Search for subdomains
• Search for subdomains takeover (dnsreaper)
• Search for live urls using gau
• Spider live urls using Katana
• Get screenshots of subdomains
• Powered by GF-Patterns
• Search for secrets, token and APIs
• Search hidden endpoints in JS urls
• Discovery dirs and files with Dirsearch
• Scan live hosts with Nmap and Vulscan NSE Script
• Run Nuclei on all live subdomains
• Search for XSS with Dalfox
• Search for SQL Injections
• Search for virtual hosts
• Search for LFI on ParamSpider results using FFUF
• Search for public resources in AWS, Azure, and Google Cloud
• Try to get origin of IPs using CloudFlair
• Get interesting URLs for XSS, SQLi, LFI, OPEN REDIRECT
• Extend searching subdomains with words permutations using altdns
• Scan for Open Redirect with Oralyzer
• Fuzzing for CRLF
• Client-side Prototype Pollution to XSS
• Search for hidden params on php/aspx endpoints with FFUF
• Search for hidden params on endpoints with Arjun
• Search for log4j vulnerability
• Search directories and file using Dirsearch

and much more !

Usage

$ git clone https://github.com/CalfCrusher/RobinHood/

$ cd RobinHood && chmod +x RobinHood.sh

Run in background:

$ nohup ./RobinHood.sh LARGE_SCOPE_DOMAIN 2>&1 &

You can also give the out-of-scope domains list separated by commas:

$ nohup ./RobinHood.sh example.com vpn.example.com,test.example.com 2>&1 &

To see progress output

$ tail -f nohup.out

Disclaimer

Be free to edit the various settings of tools related to your VPS power/bandwith. You can run this script also on your Raspberry or your DigitalOcean droplet or just where you want. It takes very long time also in base of which domain you run against to.