/Morty

Primary LanguageShell

About

  • This is my personal recon script that I use to find P4-P5 bugs.
  • This script is meant to be run on a VPS rather than a personal computer.

Usage

  • ./install.sh to fresh install the tools.
  • ./install.sh u to update the installed tools.
  • ./morty.sh <targetfile> to run the script on the scope defined in target file.
  • ./morty.sh <targetfile> <outofscopefile> to exclude subdomains in the outofscope file

Scope file

  • Should contain domain names in a list (without any regex) to enumerate on.
  • Same goes for out of scope file

Recon

  1. Brute force subdomain scan
  2. Subdomain enumeration from passive sources
  3. Third leve subdomain scan
  4. Subdomain to IP conversion
  5. Nmap vuln scan on open ports
  6. Nmap connect scan on open ports
  7. Aquatone to capture screenshots of active hosts
  8. Httpx to find active urls
  9. Waybackurls, gau to find archived links
  10. Favicon scan
  11. Template scan
  12. Automated xss finder (kxss + dalfox)
  13. Pattern Search (gf)
  14. Secret finder
  15. S3 bucket scan
  16. Directory fuzzing
  17. Cors misconfig
  18. Subdomain takeover

To be added

  • Shodan api
  • Censys api
  • Vhost enum