Skip to content

Commit b2a652c

Browse files
author
bellma101
committed
Added CORStest.
1 parent 69db499 commit b2a652c

File tree

3 files changed

+46
-5
lines changed

3 files changed

+46
-5
lines changed

‎README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ Chomp Scan supports limited canceling/skipping of tools by pressing Ctrl-c. This
3939

4040
#### Information Gathering (optional) (4 different sized wordlists)
4141
* [subjack](https://github.com/haccer/subjack)
42+
* [CORStest](https://github.com/RUB-NDS/CORStest)
4243
* [bfac](https://github.com/mazen160/bfac)
4344
* [whatweb](https://github.com/urbanadventurer/whatweb/)
4445
* [wafw00f](https://github.com/EnableSecurity/wafw00f)
@@ -104,7 +105,7 @@ Usage of Chomp Scan:
104105
-s
105106
(optional) Enable screenshots using Aquatone.
106107
-i
107-
(optional) Enable information gathering phase, using subjack, bfac, whatweb, wafw00f, and nikto.
108+
(optional) Enable information gathering phase, using subjack, CORStest, bfac, whatweb, wafw00f, and nikto.
108109
-p
109110
(optional) Enable portscanning phase, using masscan (run as root) and nmap.
110111
-I

‎chomp-scan.sh

+36-4
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ ENABLE_FFUF=0;
5050
ENABLE_GOBUSTER=0;
5151
ENABLE_DIRSEARCH=0;
5252
ENABLE_SUBJACK=0;
53+
ENABLE_CORSTEST=0;
5354
ENABLE_BFAC=0;
5455
ENABLE_WHATWEB=0;
5556
ENABLE_WAFW00F=0;
@@ -119,7 +120,7 @@ function usage() {
119120
echo -e "$BLUE""\\t-c \\n\\t\\t$ORANGE (optional) Enable content discovery phase. The wordlist for this option defaults to short if not provided.""$NC";
120121
echo -e "$BLUE""\\t-C wordlist \\n\\t\\t$ORANGE (optional) The wordlist to use for content discovery. Five built-in lists, small, medium, large, xl, and xxl can be used, as well as the path to a custom wordlist. The default is small.""$NC";
121122
echo -e "$BLUE""\\t-s \\n\\t\\t$ORANGE (optional) Enable screenshots using Aquatone.""$NC";
122-
echo -e "$BLUE""\\t-i \\n\\t\\t$ORANGE (optional) Enable information gathering phase, using subjack, bfac, whatweb, wafw00f, and nikto.""$NC";
123+
echo -e "$BLUE""\\t-i \\n\\t\\t$ORANGE (optional) Enable information gathering phase, using subjack, CORStest, bfac, whatweb, wafw00f, and nikto.""$NC";
123124
echo -e "$BLUE""\\t-p \\n\\t\\t$ORANGE (optional) Enable portscanning phase, using masscan (run as root) and nmap.""$NC";
124125
echo -e "$BLUE""\\t-I \\n\\t\\t$ORANGE (optional) Enable interactive mode. This allows you to select certain tool options and inputs interactively. This cannot be run with -D.""$NC";
125126
echo -e "$BLUE""\\t-D \\n\\t\\t$ORANGE (optional) Enable default non-interactive mode. This mode uses pre-selected defaults and requires no user interaction or options. This cannot be run with -I.""$NC";
@@ -306,6 +307,10 @@ function parse_config() {
306307
ENABLE_SUBJACK=1;
307308
fi
308309

310+
if [[ $(grep '^ENABLE_CORSTEST' "$CONFIG_FILE" | cut -d '=' -f 2) == "YES" ]]; then
311+
ENABLE_CORSTEST=1;
312+
fi
313+
309314
if [[ $(grep '^ENABLE_BFAC' "$CONFIG_FILE" | cut -d '=' -f 2) == "YES" ]]; then
310315
ENABLE_BFAC=1;
311316
fi
@@ -1583,7 +1588,7 @@ function run_corstest() {
15831588
DIFF=$(( END - START ));
15841589
echo -e "$GREEN""[i]$BLUE CORStest took $DIFF seconds to run.""$NC";
15851590
else
1586-
echo -e "$GREEN""[i]$BLUE Running CORStest against all $(wc -l "$2" | cut -d ' ' -f 1) unique discovered domains.""$NC";
1591+
echo -e "$GREEN""[i]$BLUE Running CORStest against all $(wc -l "$2" | cut -d ' ' -f 1) discovered interesting domains.""$NC";
15871592
echo -e "$GREEN""[i]$BLUE Command: corstest.py $2 -v -p 64 | tee $WORKING_DIR/CORStest-output.txt.""$NC";
15881593
# Run CORStest
15891594
START=$(date +%s);
@@ -1599,7 +1604,7 @@ function run_information_gathering() {
15991604
# Ask user to do information gathering on discovered domains
16001605
while true; do
16011606
echo -e "$GREEN""[?] Do you want to begin information gathering on [A]ll/[I]nteresting/[N]o discovered domains?";
1602-
echo -e "$ORANGE""[i] This will run subjack, bfac, whatweb, wafw00f, and nikto.";
1607+
echo -e "$ORANGE""[i] This will run subjack, CORStest, bfac, whatweb, wafw00f, and nikto.";
16031608
read -rp "[?] Please enter A/a, I/i, or N/n. " ANSWER
16041609

16051610
case $ANSWER in
@@ -1616,6 +1621,7 @@ while true; do
16161621
case $CHOICE in
16171622
[sS]* )
16181623
run_subjack "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
1624+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16191625
run_bfac "$WORKING_DIR"/"$ALL_RESOLVED";
16201626
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16211627
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
@@ -1624,6 +1630,7 @@ while true; do
16241630
;;
16251631
[mM]* )
16261632
run_subjack "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
1633+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16271634
run_bfac "$WORKING_DIR"/"$ALL_RESOLVED";
16281635
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16291636
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
@@ -1632,6 +1639,7 @@ while true; do
16321639
;;
16331640
[lL]* )
16341641
run_subjack "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
1642+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16351643
run_bfac "$WORKING_DIR"/"$ALL_RESOLVED";
16361644
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16371645
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
@@ -1640,6 +1648,7 @@ while true; do
16401648
;;
16411649
[xX]* )
16421650
run_subjack "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
1651+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16431652
run_bfac "$WORKING_DIR"/"$ALL_RESOLVED";
16441653
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16451654
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
@@ -1648,6 +1657,7 @@ while true; do
16481657
;;
16491658
[2]* )
16501659
run_subjack "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
1660+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16511661
run_bfac "$WORKING_DIR"/"$ALL_RESOLVED";
16521662
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
16531663
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
@@ -1685,6 +1695,7 @@ while true; do
16851695
case $CHOICE in
16861696
[sS]* )
16871697
run_subjack "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
1698+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
16881699
run_bfac "$WORKING_DIR"/"$INTERESTING_DOMAINS";
16891700
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
16901701
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
@@ -1693,6 +1704,7 @@ while true; do
16931704
;;
16941705
[mM]* )
16951706
run_subjack "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
1707+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
16961708
run_bfac "$WORKING_DIR"/"$INTERESTING_DOMAINS";
16971709
run_whatweb "$WORKING_DIR"/"$INTERESTING_DOMAINS";
16981710
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
@@ -1701,6 +1713,7 @@ while true; do
17011713
;;
17021714
[lL]* )
17031715
run_subjack "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
1716+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
17041717
run_bfac "$WORKING_DIR"/"$INTERESTING_DOMAINS";
17051718
run_whatweb "$WORKING_DIR"/"$INTERESTING_DOMAINS";
17061719
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
@@ -1709,6 +1722,7 @@ while true; do
17091722
;;
17101723
[xX]* )
17111724
run_subjack "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
1725+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
17121726
run_bfac "$WORKING_DIR"/"$INTERESTING_DOMAINS";
17131727
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
17141728
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
@@ -1717,6 +1731,7 @@ while true; do
17171731
;;
17181732
[2]* )
17191733
run_subjack "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
1734+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
17201735
run_bfac "$WORKING_DIR"/"$INTERESTING_DOMAINS";
17211736
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
17221737
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
@@ -1949,6 +1964,18 @@ if [[ "$CONFIG_FILE" != "" ]]; then
19491964
fi
19501965
fi
19511966

1967+
# Run CORStest
1968+
if [[ "$ENABLE_CORSTEST" -eq 1 ]]; then
1969+
if [[ "$USE_ALL" == 1 ]]; then
1970+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
1971+
# Make sure there are interesting domains
1972+
elif [[ $(wc -l "$WORKING_DIR"/"$INTERESTING_DOMAINS" | cut -d ' ' -f 1) -gt 0 ]]; then
1973+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
1974+
else
1975+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
1976+
fi
1977+
fi
1978+
19521979
# Run bfac
19531980
if [[ "$ENABLE_BFAC" -eq 1 ]]; then
19541981
if [[ "$USE_ALL" == 1 ]]; then
@@ -2050,6 +2077,7 @@ if [[ "$DEFAULT_MODE" == 1 ]]; then
20502077
run_masscan;
20512078
run_nmap;
20522079
run_subjack "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
2080+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
20532081
run_bfac "$WORKING_DIR"/"$ALL_RESOLVED";
20542082
run_nikto "$WORKING_DIR"/"$ALL_RESOLVED";
20552083
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
@@ -2146,27 +2174,30 @@ fi
21462174

21472175
# -i information gathering
21482176
if [[ "$INFO_GATHERING" == 1 ]]; then
2149-
echo -e "$BLUE""[i] Beginning information gathering with subjack, bfac, whatweb, wafw00f, and nikto.""$NC";
2177+
echo -e "$BLUE""[i] Beginning information gathering with subjack, CORStest, bfac, whatweb, wafw00f, and nikto.""$NC";
21502178
sleep 0.5;
21512179

21522180
# Call unique to make sure list is up to date for content discovery
21532181
unique;
21542182

21552183
if [[ "$USE_ALL" == 1 ]]; then
21562184
run_subjack "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
2185+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
21572186
run_bfac "$WORKING_DIR"/"$ALL_RESOLVED";
21582187
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
21592188
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
21602189
run_nikto "$WORKING_DIR"/"$ALL_RESOLVED";
21612190
# Make sure there are interesting domains
21622191
elif [[ $(wc -l "$WORKING_DIR"/"$INTERESTING_DOMAINS" | cut -d ' ' -f 1) -gt 0 ]]; then
21632192
run_subjack "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
2193+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
21642194
run_bfac "$WORKING_DIR"/"$INTERESTING_DOMAINS";
21652195
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
21662196
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$INTERESTING_DOMAINS";
21672197
run_nikto "$WORKING_DIR"/"$INTERESTING_DOMAINS";
21682198
else
21692199
run_subjack "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
2200+
run_corstest "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
21702201
run_bfac "$WORKING_DIR"/"$ALL_RESOLVED";
21712202
run_whatweb "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
21722203
run_wafw00f "$DOMAIN" "$WORKING_DIR"/"$ALL_RESOLVED";
@@ -2249,6 +2280,7 @@ list_found;
22492280
# Calculate scan runtime
22502281
SCAN_END=$(date +%s);
22512282
SCAN_DIFF=$(( SCAN_END - SCAN_START ));
2283+
22522284
if [[ "$NOTICA" != "" ]]; then
22532285
run_notica;
22542286
fi

‎installer.sh

+8
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ function install_kali() {
2222
install_massdns;
2323
install_aquatone;
2424
install_sublist3r;
25+
install_corstest;
2526
install_go_tools;
2627
}
2728
function install_debian() {
@@ -35,6 +36,7 @@ function install_debian() {
3536
install_massdns;
3637
install_aquatone;
3738
install_sublist3r;
39+
install_corstest;
3840
install_nikto;
3941
install_go;
4042
install_go_tools;
@@ -49,6 +51,7 @@ function install_ubuntu() {
4951
install_massdns;
5052
install_aquatone;
5153
install_sublist3r;
54+
install_corstest;
5255
install_go;
5356
install_go_tools;
5457
}
@@ -108,6 +111,11 @@ function install_dirsearch() {
108111
git clone https://github.com/maurosoria/dirsearch.git "$TOOLS"/wafw00f;
109112
}
110113

114+
function install_corstest() {
115+
echo -e "$GREEN""Installing CORStest from Github.""$NC";
116+
git clone https://github.com/RUB-NDS/CORStest.git "$TOOLS"/CORStest;
117+
}
118+
111119
function install_go_tools() {
112120
source $HOME/.profile;
113121
echo -e "$GREEN""Installing Go tools from Github.""$NC";

0 commit comments

Comments
 (0)