Sn1per - Sn1per Community Edition is an automated scanner t

项目说明

!alt tag

![GitHub release]()
![GitHub issues]()
![Github Stars]()
![GitHub Followers]()
![Tweet]()
![Follow on Twitter]()

ABOUT:

Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for . Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage large en and pentest scopes. For more information regarding Sn1per Professional, go to

SN1PER PROFESSIONAL FEATURES:

Professional reporting interface

![]()

Slideshow for all gathered screenshots

![]()

Searchable and sortable DNS, IP and open port database

![]()

Detailed host reports

![]()

NMap HTML host reports

![]()

Quick links to online recon tools and Google hacking queries

![]()

Takeovers and Email Security

![]()

HTML5 Notepad

![]()

ORDER SN1PER PROFESSIONAL:

To obtain a Sn1per Professional license, go to

DEMO VIDEO:

![Demo]()

SN1PER COMMUNITY FEATURES:

[x] Automatically collects basic recon (ie. whois, ping, DNS, etc.)

[x] Automatically launches Google hacking queries against a target domain

[x] Automatically enumerates open ports via NMap port scanning

[x] Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers

[x] Automatically checks for sub-domain hijacking

[x] Automatically runs targeted NMap scripts against open ports

[x] Automatically runs targeted Metasploit scan and exploit modules

[x] Automatically scans all web applications for common

[x] Automatically brute forces ALL open services

[x] Automatically test for anonymous FTP access

[x] Automatically runs WPScan, Arachni and Nikto for all web services

[x] Automatically enumerates NFS shares

[x] Automatically test for anonymous LDAP access

[x] Automatically enumerate SSL/TLS ciphers, protocols and

[x] Automatically enumerate SNMP community strings, services and users

[x] Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067

[x] Automatically exploit JBoss, Java RMI and Tomcat servers

[x] Automatically tests for open X11 servers

[x] Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds

[x] Performs high le of multiple hosts and subnets

[x] Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting

[x] Automatically gathers screenshots of all web sites

[x] Create indi workspaces to store all scan output

AUTO-PWN:

[x] Apache Struts C RCE exploit

[x] Android Insecure ADB RCE auto exploit

[x] Apache Tomcat C RCE exploit

[x] Oracle WebLogic WLS-WSAT Component Deserialisation RCE C exploit

[x] Drupal Drupalgedon2 RCE C

[x] GPON Router RCE C

[x] Apache Struts 2 RCE C

[x] Apache Struts 2 RCE C

[x] Apache Jakarta RCE C

[x] Shellshock GNU Bash RCE C

[x] HeartBleed OpenSSL Detection C

[x] Default Apache Tomcat Creds C

[x] MS Windows SMB RCE MS08-067

[x] Webmin File Disclosure C

[x] Anonymous FTP Access

[x] PHPMyAdmin Backdoor RCE

[x] PHPMyAdmin Auth Bypass

[x] JBoss Ja RCE's

KALI LINUX INSTALL:

USAGE:

MODES:

* NORMAL: Performs basic scan of targets and open ports using both active and passi for optimal performance.
* STEALTH: Quickly enumerate single targets using mostly non-intrusi to avoid WAF/IPS blocking.
* FLYOVER: Fast multi-threaded high le of multiple targets (useful for collecting high level data on many hosts quickly).
* AIRSTRIKE: Quickly enumerates open ports/services on multiple hosts and performs basic fingerprinting. To use, specify the full location of the file which contains all hosts, IPs that need to be scanned and run ./sn1per /full/path/to/targets.txt airstrike to begin scanning.
* NUKE: Launch full audit of multiple hosts specified in text file of choice. Usage example: ./sniper /pentest/loot/targets.txt nuke.
* DISCOVER: Parses all hosts on a subnet/CIDR (ie. 192.168.0.0/16) and initiates a sniper scan against each host. Useful for internal network scans.
* PORT: Scans a specific port for . Reporting is not currently a in this mode.
* FULLPORTONLY: Performs a full detailed port scan and sa to XML.
* WEB: Adds full automatic web application scans to the results (port 80/tcp & 443/tcp only). Ideal for web applications but may increase scan time significantly.
* WEBPORTHTTP: Launches a full HTTP web application scan against a specific host and port.
* WEBPORTHTTPS: Launches a full HTTPS web application scan against a specific host and port.

SAMPLE REPORT:

LICENSE:

This software is free to distribute, modify and use with the condition that credit is provided to the creator (xer0dayz) and is not for commercial use. Permission to distribute any part of the code for sale is strictly prohibited.

DONATIONS:

Donations are welcome. This will help fascilitate impro, frequent updates and better o support for sniper.

[x] BTC 1FaxuJJwFyKum

[x] ETH 0x20bB09273702eaBDFbEE9809473Fd04b969a794d

[x] LTC LQ6mPewec3xeLBYMdRP4yzeta6b9urqs2f

[x] XMR 4JUdGz4LkCnKBPRzDuhzi5oRUrEDAgRwsQ

[x] ZCASH t1fsizsk2cqqJAjRoUmXJSyo

项目信息

开发语言：Shell

Star 数：13

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。