[ZanGetsu]

XRay is a tool for network OSINT gathering, its goal is to make some of the initial tasks of information gathering and network mapping automatic.

How Does it Work?

XRay is a very simple tool, it works this way:

1. It'll bruteforce subdomains using a wordlist and DNS requests.
   
2. For every subdomain/ip found, it'll use Shodan to gather open ports and other intel.
   
3. If a ViewDNS API key is provided, for every subdomain historical data will be collected.
   
4. For every unique ip address, and for every open port, it'll launch specific banner grabbers and info collectors.
   
5. Eventually the data is presented to the user on the web ui.
   
6. Grabbers and Collectors
   

• HTTP Server, X-Powered-By and Location headers.
  
• HTTP and HTTPS robots.txt disallowed entries.
  
• HTTPS certificates chain ( with recursive subdomain grabbing from CN and Alt Names ).
  
• HTML title tag.
  
• DNS version.bind. and hostname.bind. records.
  
• MySQL, SMTP, FTP, SSH, POP and IRC banners.
  

Usage:

Code:

Usage: xray -shodan-key YOUR_SHODAN_API_KEY -domain TARGET_DOMAIN Options:  -address string        IP address to bind the web ui server to. (default "127.0.0.1")  -consumers int        Number of concurrent consumers to use for subdomain enumeration. (default 16)  -domain string        Base domain to start enumeration from.  -port int        TCP port to bind the web ui server to. (default 8080)  -preserve-domain        Do not remove subdomain from the provided domain name.  -session string        Session file name. (default "<domain-name>-xray-session.json")  -shodan-key string        Shodan API key.  -viewdns-key string        ViewDNS API key.  -wordlist string        Wordlist file to use for enumeration. (default "wordlists/default.lst")

Example:

Code:

# xray -shodan-key yadayadayadapicaboo... -viewdns-key foobarsomethingsomething... -domain fbi.gov ____  ___ \   \/  / \     RAY v 1.0.0b /    by Simone 'evilsocket' Margaritelli /___/\  \      \_/ @ Saving session to fbi.gov-xray-session.json @ Web UI running on http://127.0.0.1:8080/

Download