automator.sh - (Unfinished)

#!/bin/bash

#Automatically run recon against a domain/list of domains.
#Built for Backtrack
#
# Current Features: 
# * DNS Recon
# * Email Harvesting
# * Meta Data Enumeration
# * WhoIs
#
# Additional Features
# * Pull domains from SSL Certificate
#
# Usage: ./automator.sh domainlist.txt
# Usage: ./automator.sh domain.com
#
# By: Leon Teale (RandomStorm)
#

## Setting Coloured variables
red=`echo -e "\033[31m"`
lcyan=`echo -e "\033[36m"`
yellow=`echo -e "\033[33m"`
green=`echo -e "\033[32m"`
blue=`echo -e "\033[34m"`
purple=`echo -e "\033[35m"`
normal=`echo -e "\033[m"`

## Set Variables
domain=$1

 
## Define Function
HEADER(){
clear
echo "$yellow                _                        _             "
echo "$yellow     /\        | |                      | |            "
echo "$yellow    /  \  _   _| |_ ___  _ __ ___   __ _| |_ ___  _ __ "
echo "$yellow   / /\ \| | | | __/ _ \| '_ \` _ \ / _\` | __/ _ \| '__|"
echo "$yellow  / ____ \ |_| | || (_) | | | | | | (_| | || (_) | | "  
echo "$yellow /_/    \_\__,_|\__\___/|_| |_| |_|\__,_|\__\___/|_|$normal"
echo "$lcyan  -- by Leon Teale (Randomstorm)"
echo ""
echo "$blue +-------------------------------------------+"
echo "$blue | $red Current Features$normal                      $blue   |$normal"
echo "$blue | $yellow * DNS Recon$normal                           $blue   |$normal"
echo "$blue | $yellow * Email Harvesting$normal                     $blue  |$normal"
echo "$blue | $yellow * Meta DataEnumeration$normal                 $blue  |$normal"
echo "$blue | $yellow * WhoIs$normal                                  $blue|$normal"
echo "$blue |                                           |"
echo "$blue | $red Additional Features            $normal         $blue |$normal"
echo "$blue | $yellow * Pull domains From SSL Cert$normal$blue             |$normal"
echo "$blue +-------------------------------------------+$normal"
echo ""
}

DNS_RECON(){
echo "$yellow Running DNS Recon Stage against $lcyan$domain$yellow..$normal"
echo ""
#domain_ns=`dig ns $domain | grep -v '^;' | grep A | cut -f1 | head -1`
dig ns $domain | grep -v '^;' | grep NS | awk {'print $5'} | head -1 > $output_dir/$domain/domain_ns.txt.tmp
if 
dig @`cat $output_dir/$domain/domain_ns.txt.tmp` $domain axfr | grep "XFR size" > /dev/null
then
echo "$lcyan Zone Transfer Vulnerability: ($red Yes $lcyan)$normal"
else
echo "$lcyan Zone Transfer Vulnerability: ($green No $lcyan)$normal"
fi
rm $output_dir/$domain/domain_ns.txt.tmp
echo ""
/pentest/enumeration/dns/dnsrecon/dnsrecon.py -t brt,std,axfr -D /pentest/enumeration/dns/dnsrecon/namelist.txt -d $domain > /tmp/$domain.dnsrecon.txt.tmp
cat /tmp/$domain.dnsrecon.txt.tmp | grep '[^\.][0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}[^\.]' | grep -vE 'Trying|TCP|spf1|SOA|Has' | awk {'print $3 "\t" $4'} | sort -u  | grep $domain | sed '/^$/d' > $output_dir/$domain/dnsrecon.txt
echo "$lcyan Subdomains found: ($yellow `cat $output_dir/$domain/dnsrecon.txt | wc -l` $lcyan)$normal"
echo ""
rm -rf /tmp/$domain.dnsrecon.txt.tmp
echo "" >> $output_dir/$domain/dnsrecon.txt
echo "Name Servers" >> $output_dir/$domain/dnsrecon.txt
dig ns $domain | grep -v '^;' | grep A | awk {'print $1 "\t" $5'} | sed '/^$/d' >> $output_dir/$domain/dnsrecon.txt
echo "" >> $output_dir/$domain/dnsrecon.txt
echo "MX Records" >> $output_dir/$domain/dnsrecon.txt
dig mx $domain | grep -v '^;' | grep $domain | awk {'print $6'} | sed '/^$/d' >> $output_dir/$domain/dnsrecon.txt
cat $output_dir/$domain/dnsrecon.txt
echo ""
echo "$green DNS Recon Stage Complete!$normal"
}

HARVESTER(){
echo "$yellow Running Email Harvesting Stage..$normal"
/pentest/enumeration/theharvester/theHarvester.py -l 500 -b all -d $domain > /tmp/$domain.emails.txt.tmp
cat /tmp/$domain.emails.txt.tmp |  grep @ | grep -vE 'cmartore' > $output_dir/$domain/emails.txt
rm -rf /tmp/$domain.emails.txt.tmp
echo "$lcyan Email Addresses Found: ($yellow `cat $output_dir/$domain/emails.txt | wc -l` $lcyan)$normal"
echo "" 
cat $output_dir/$domain/emails.txt | column -c 100
echo ""
echo "$green Email Harvesting Stage Complete!$normal"
}

METADATA(){
echo "$yellow Running Meta Data Gathering Stage..$normal"
echo ""
/pentest/enumeration/google/metagoofil/metagoofil.py -d $domain -t pdf,doc,xls,ppt,odp,ods,docx,xlsx,pptx -l 20 -n 20  -o $output_dir/$domain/metagoofil/ -f $output_dir/$domain/users_temp.txt > /dev/null
cat $output_dir/$domain/users_temp.txt | sed 's/useritem/\n/g' | grep '">' | grep -vE 'head' | awk -F "<" {'print $1'} | cut -d">" -f2 | sed -e "s/^ \{1,\}//" > $output_dir/$domain/users.txt
echo "$lcyan Users found: ($yellow `cat $output_dir/$domain/users.txt | wc -l` $lcyan)$normal"
echo ""
cat $output_dir/$domain/users.txt
echo ""
echo "$green Meta Data Stage Complete!$normal"
}

WHOIS(){
whois $domain > $output_dir/$domain/whois.txt
echo "$yellow Running WhoIs..$normal"
echo ""
echo "$green WhoIs output saved to: $lcyan $output_dir/$domain/whois.txt$normal"
}

SSL_CERT(){
echo "$yellow Pulling Domains from SSL Certificates $normal"
echo ""
sslscan --ssl2 $domain | grep DNS | sed 's/,/"\n"/g' | sed 's/"//g' | cut -d':' -f2 > $output_dir/$domain/sslcertdomains_temp.txt
nmap -vv $domain -script=ssl-cert -p443 | grep commonName | grep -v 'Issuer' | cut -d '/' -f1 | cut -d '=' -f2 >> $output_dir/$domain/sslcertdomains_temp.txt
cat $output_dir/$domain/sslcertdomains_temp.txt | sort -u > $output_dir/$domain/sslcertdomains.txt
cat $output_dir/$domain/sslcertdomains.txt
rm $output_dir/$domain/sslcertdomains_temp.txt
echo ""
echo "$green Finished Pulling Domains!$normal"
echo ""
}

OPTIONS(){
echo "$yellow Run intense scan? [y/N]$normal"
read intense
if 
[[ "$intense" == [yY] ]]
then
intense_scan=true
else
intense_scan=false
fi
echo "$yellow Set output directory: [Leave blank for ~/Desktop/]$normal"
read output
if
[ "$output" == "" ]
then
output_dir="~/Desktop"
else
output_dir=$output
fi

mkdir -p $output_dir/$domain
mkdir -p $output_dir/$domain/metagoofil

}




## Check for usage
if [ -z "$1" ];
then
echo ""
echo "Usage: ./automator.sh listofdomains.txt"
echo "Usage: ./automator.sh domain.com"
echo ""









## Run script for list of domains
elif [ -f "$1" ];
then

HEADER

## Set additional  options
OPTIONS

for domain in `cat $1`;
do

mkdir -p $output_dir/$domain
mkdir -p $output_dir/$domain/metagoofil
sleep 1


## Run the DNS Stage
echo "$red+------------------------------------------------+$normal"
echo ""
DNS_RECON

## Run the Mail Harvesting Stage
echo "$red+------------------------------------------------+$normal"
echo ""
HARVESTER

## Run the MetaGooFil Stage
echo "$red+------------------------------------------------+$normal"
echo ""
METADATA

## Run the WhoIs
echo "$red+------------------------------------------------+$normal"
echo ""
WHOIS

## Pull domains from SSL Certificate
echo "$red+------------------------------------------------+$normal"
echo ""
SSL_CERT

done









## Run script for single domain usage
else

HEADER

## Set additional  options
OPTIONS

mkdir -p $output_dir/$domain
mkdir -p $output_dir/$domain/metagoofil
sleep 1

## Run the DNS Stage
echo "$red+------------------------------------------------+$normal"
echo ""
DNS_RECON

## Run the Mail Harvesting Stage
echo "$red+------------------------------------------------+$normal"
echo ""
HARVESTER

## Run the MetaGooFil Stage
echo "$red+------------------------------------------------+$normal"
echo ""
METADATA

## Run the WhoIs
echo "$red+------------------------------------------------+$normal"
echo ""
WHOIS

## Pull domains from SSL Certificate
echo "$red+------------------------------------------------+$normal"
echo ""
SSL_CERT


fi