CorpTrace

CorpTrace is a framewok that supports the process of collecting information about a target company in the context of a red team assessment. I wrote this tool primarily to automate my workflow, so I'm sure it's still buggy for some cases.

Usage

The core is the modules.json file, which contains the syntax for commands that will be executed. It contains tools from other sources as well as some custom scripts. Some of these modules require API keys. These keys can be stored in the build/config.json file.

Since CorpTrace calls multiple endpoints, repeated execution of the tool can lead to the IP address in used being blocked or the API keys being exhausted. It is possible to obtain an overview of the consumption of the individual API keys using ressources/scripts/print_api_keys.sh.

Each module has its own risk level. This level is made up of several factors, for example if the module sends several requests or if the module accesses the target company's infrastructure. Executing CorpTrace with a high risk level and many simultaneous modules could have a negative impact on results.

Depending on the input, some modules may take very long to terminate. To prevent timeouts of the individual modules, the duration of the timeout window can be adjusted during execution.

The following command executes all available modules for a domain up to risk level 2:

python3 corptrace.py -o /tmp/out -d r1cksec.de -e

Install

The installation script was developed for Kali Linux. Before running the installation, it is recommended to store API keys in the corresponding configuration file.

bash install.sh

To reinstall / overwrite all tools, the following argument can be specified.

bash install.sh -force

Demo

Example of collecting data:

Example of the visualization of the collected data:

Help

usage: corptrace.py [-h] -o OUTPUT [-e] [-v] [-p] [-g [{dark,light}]] [-to TIMEOUT] [-rl RISKLEVEL] [-ta THREADAMOUNT] [-em [EXCLUDEMODULES ...]]
                    [-im [INCLUDEMODULES ...]] [-a ASN] [-c COMPANY] [-d DOMAIN] [-f FILEDOMAINS] [-gu GITHUBUSER] [-gi GOOGLEID] [-i IPCIDR] [-n NAMESERVER]
                    [-r REPOSITORY]

Automate OSINT/Recon assessment.
Use at your own risk.

Basic usage:
Print matching modules for a given domain:
python3 corptrace.py -o /tmp/out -d r1cksec.de

Execute modules for given github user:
python3 corptrace.py -o /tmp/out -gu r1cksec -e

Print syntax of modules for given file containing domains:
python3 corptrace.py -o /tmp/out -f /tmp/domains -v

Only execute modules that contain at least one of the given substring in their name:
python3 corptrace.py -o /tmp/out -c 'companyName' -im shodan -e

Execute modules up to risk level 3, use 8 threads and increase timeout to 35 minutes:
python3 corptrace.py -o /tmp/out -rl 3 -ta 8 -to 2100 -i '192.168.1.1/24' -e

Print overview of results:
python3 corptrace.py -o /tmp/out -p

Generate graph based on dnsx_get_coherent_domains results:
python3 corptrace.py -o /tmp/out -g

options:
  -h, --help            show this help message and exit
  -o OUTPUT, --output OUTPUT
                        path to output directory
  -e, --execute         execute matching commands
  -v, --verbose         print full command
  -p, --print           print overview of results
  -g [{dark,light}], --graph [{dark,light}]
                        generate graph using dnsx_get_coherent_domains results
  -to TIMEOUT, --timeOut TIMEOUT
                        maximal time that a single thread is allowed to run in seconds (default 1200)
  -rl RISKLEVEL, --riskLevel RISKLEVEL
                        set maximal riskLevel for modules (possible values 1-4, 2 is default)
  -ta THREADAMOUNT, --threadAmount THREADAMOUNT
                        the amount of parallel running threads (default 5)
  -em [EXCLUDEMODULES ...], --exludeModules [EXCLUDEMODULES ...]
                        modules that will be excluded (exclude ovewrites include)
  -im [INCLUDEMODULES ...], --includeModules [INCLUDEMODULES ...]
                        modules that will be included
  -a ASN, --asn ASN
  -c COMPANY, --company COMPANY
  -d DOMAIN, --domain DOMAIN
  -f FILEDOMAINS, --filedomains FILEDOMAINS
  -gu GITHUBUSER, --githubUser GITHUBUSER
  -gi GOOGLEID, --googleId GOOGLEID
  -i IPCIDR, --ipcidr IPCIDR
  -n NAMESERVER, --nameserver NAMESERVER
  -r REPOSITORY, --repository REPOSITORY

Modules

columbus_get_subdomains
crtsh_get_rootdomains
csprecon
dns_get_records
dns_get_top_level_domains
dnslytics_get_rootdomains
dnsreaper
dnstwist
dnsx_get_coherent_domains
git_get_secrets
git_grep_commits
github_get_organisation_member
github_get_repositories
github_search_accounts
google_get_linkedIn_employees
startpage_get_pdf_metadata
gpg_get_emails
grayhatwarfare_get_buckets
hackertarget_get_rootdomains_from_cidr
hackertarget_get_rootdomains_from_gid
hackertarget_get_rootdomains_from_nameserver
handelsregister_get_company_names
hunter_get_emails
letItGo
massdns
msteams_phishing
myssl_get_subdomains
networksdb_get_company_names
networksdb_get_ipranges
nmap_get_tls_alternative_names
nmap_reverse_lookup
northdata_get_company_names
onyphe_get_rootdomains
phonebook_get_mails
robtex_get_rootdomains
securitytrails_get_ip_history
shodan_get_ports_from_cidr
shodan_get_rootdomains_from_company
shodan_get_rootdomains_from_domain
skymem_get_mails
spk
spoofy
spyonweb_get_rootdomains
subdomaincenter_get_subdomains
subfinder
tmdb_get_company_names
tomba_get_emails
urlscan_get_rootdomains_from_company
urlscan_get_rootdomains_from_domain
urlscan_get_subdomains
validin_get_rootdomains_from_cidr
validin_get_rootdomains_from_domain
whois_get_ips
xing_get_employees
zoomeye_get_ports_from_cidr
zoomeye_get_rootdomains_from_domain
whoxy_get_rootdomains