Sn1per is an automated pentest recon scanner that can be used during a penetration test to enumerate and scan for vulnerabilities.
- Automatically collects basic recon (ie. whois, ping, DNS, etc.)
- Automatically launches Google hacking queries against a target domain
- Automatically enumerates open ports
- Automatically brute forces sub-domains and DNS info
- Automatically runs targeted NMap scripts against open ports
- Automatically runs targeted Metasploit scan and exploit modules
- Automatically scans all web applications for common vulnerabilities
- Automatically brute forces all open services
- Automatically exploit remote hosts to gain remote shell access
- Performs high level enumeration of multiple hosts
- Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
./install.sh - Installs all dependencies OR upgrades existing Sn1per installations. Best run from Kali Linux.
# sniper <target> <report> # sniper <target> stealth <report> # sniper <CIDR> discover # sniper <target> port <portnum> # sniper <target> web <report> # sniper <target> nobrute <report> # sniper <targets.txt> airstrike <report> # sniper <targets.txt> nuke <report>
Outputs all results to text in the loot directory for later reference. To enable reporting, append ‘report’ to any sniper mode or command.
Quickly enumerate single targets using mostly non-intrusive scans to avoid WAF/IPS blocking
Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans.
Scans a specific port for vulnerabilities. Reporting is not currently available in this mode.
Adds full automatic web application scans to the results (port 80/tcp & 443/tcp only). Ideal for web applications but may increase scan time significantly.
Launches a full scan against a target host/domain without brute forcing services.
Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IP’s that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.
Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke.