+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.ly/Forum-Hacking-Tools)
+--- Thread: XRay - tool for recon, mapping and OSINT gathering from public networks (/Thread-XRay-tool-for-recon-mapping-and-OSINT-gathering-from-public-networks)
XRay - tool for recon, mapping and OSINT gathering from public networks - ZanGetsu - 09-03-2017
XRay is a tool for network OSINT gathering, its goal is to make some of the initial tasks of information gathering and network mapping automatic.
How Does it Work?
XRay is a very simple tool, it works this way:
- It'll bruteforce subdomains using a wordlist and DNS requests.
- For every subdomain/ip found, it'll use Shodan to gather open ports and other intel.
- If a ViewDNS API key is provided, for every subdomain historical data will be collected.
- For every unique ip address, and for every open port, it'll launch specific banner grabbers and info collectors.
- Eventually the data is presented to the user on the web ui.
- Grabbers and Collectors
- HTTP Server, X-Powered-By and Location headers.
- HTTP and HTTPS robots.txt disallowed entries.
- HTTPS certificates chain ( with recursive subdomain grabbing from CN and Alt Names ).
- HTML title tag.
- DNS version.bind. and hostname.bind. records.
- MySQL, SMTP, FTP, SSH, POP and IRC banners.
Usage:
Code:
Usage: xray -shodan-key YOUR_SHODAN_API_KEY -domain TARGET_DOMAIN
Options:
-address string
IP address to bind the web ui server to. (default "127.0.0.1")
-consumers int
Number of concurrent consumers to use for subdomain enumeration. (default 16)
-domain string
Base domain to start enumeration from.
-port int
TCP port to bind the web ui server to. (default 8080)
-preserve-domain
Do not remove subdomain from the provided domain name.
-session string
Session file name. (default "<domain-name>-xray-session.json")
-shodan-key string
Shodan API key.
-viewdns-key string
ViewDNS API key.
-wordlist string
Wordlist file to use for enumeration. (default "wordlists/default.lst")Example:
Code:
# xray -shodan-key yadayadayadapicaboo... -viewdns-key foobarsomethingsomething... -domain fbi.gov
____ ___
\ \/ /
\ RAY v 1.0.0b
/ by Simone 'evilsocket' Margaritelli
/___/\ \
\_/
@ Saving session to fbi.gov-xray-session.json
@ Web UI running on http://127.0.0.1:8080/