Passive recon / OSINT automation script:

• Runs passive recon tools specified in config file given a TLD
• Extracts email addresses, IP addresses, and DNS names from tool output using regex
• Queries various OSINT sites specified in config file for TLD and saves result to specified format (default pdf)
• Runs additional recon tools and website queries on IPs and DNS names found from initial TLD analysis
• All identified domains, emails, ip addresses, dns names, and tool run history / output stored in sqlite database
• Aggressive mode can be enabled for running non-passive tests on discovered hosts (e.g. screenshot and spider a website)

By default, the application runs in interactive mode allowing the user to select a project name / output directory as well as add multiple TLDs for analysis before executing scripted tasks. Optionally, a single domain can be specified as a command line parameter to immediately create a new project and execute the scripted tasks against that domain upon launch.

All scan parameters are pulled from config files so multiple configurations can be developed and specified with the -c flag. An example config file (default.example) is included and will be copied into the default path (default.cfg) upon initial launch.

Please feel free to submit PR for bugfixes or additional tools/sites/regex for default config file - any feedback, input, or improvement is greatly appreciated!

Script tested on Kali Linux as well as OSX and should function on UNIX-based systems with required dependencies.

• pyPdf (installed on Kali Linux by default)
• elixir apt-get install python-elixir

• cutycapt (installed on Kali Linux by default)

• webshag (installed by default on Kali 1.x but not 2.x) apt-get install webshag

• Email domain filter currently only excludes emails not matching the active domain during TLD phase
• HTML index page to summarize all output
• Scrape cutycapt output for targets & emails (convert to text first?)

Copyright 2015

Matthew C. Jones, CPA, CISA, OSCP

IS Audits & Consulting, LLC - http://www.isaudits.com/

TJS Deemer Dana LLP - http://www.tjsdd.com/

Concept based upon functionality observed in the OSINT portion of the Kali Discover script by leebaird: https://github.com/leebaird/discover/

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.