azimut / autoaim

recon helpers

autoaim

Personal use, paths assumed to exist.

dependencies

• postgresql
• sunny cli util to gather metadata of an ip
• hacks cli utils to handle structured data (nmap xml, ip address ranges, etc)
• nmap
• amass
• nikto
• massdns
• subjack
• aquatone
• hakwarwler
• SubDomanizer
• uriinteresting
• unfurl
• zonemaster
• oneforall
• trusttrees

discover

domain.sh

get subdomains from domain

domain-brute.sh

bruteforces domain using jhaddix all.txt

domain-resolve.sh

resolves subdomains found + tries some variations and subdomains from siblings

scan

up.sh

ping scan ips found and get basic informations from them, like if they belong to cloud providers

scan.sh

nmap TCP, UDP and TCPFULL just to discover open ports

resolvers

resolvers.txt, raw_resolvers.txt

cleanup resolvers version of IPs from massdns based on cleanupresolvers.sh

TLD specific

tlds.sh

generates the report for possible tlds for said domain

clean_public_suffix.dat

version that does not contain comments, explicit wildcards and non-explicit ones

cleanupwildcards.sh

generates a new clean_public_suffix_list.dat

massdns_wildcard.txt

contains only domains that have wildcard from public_suffix.dat