Site icon Kali Linux Tutorials

Karma_V2 : A Passive Open Source Intelligence (OSINT) Automated Reconnaissance (Framework)

R K
Karma_V2 : A Passive Open Source Intelligence (OSINT) Automated Reconnaissance (Framework)

Karma_V2 can be used by Infosec Researchers, Penetration Testers, Bug Hunters to find deep information, more assets, WAF/CDN bypassed IPs, Internal/External Infra, Publicly exposed leaks and many more about their target. Shodan Premium API key is required to use this automation. Output from the πš”πšŠπš›πš–πšŠ 𝚟𝟸 is displayed to the screen and saved to files/directories.

β„ΉΒ Regarding Premium Shodan API, Please see the Shodan site for more information.

Shodan website:Β Shodan WebsiteΒ API :Β Developer API

Features

Installation

Clone the repo

# git clone https://github.com/Dheerajmadhukar/karma_v2.git

Β Install shodan & mmh3 python module

# python3 -m pip install shodan mmh3

Β Install JSON Parser [JQ]

#apt install jq -y

Install httprobeΒ @tomnomnomΒ to probe the requests

#GO111MODULE=on go get -v github.com/tomnomnom/httprobe

Install InterlaceΒ @codingoΒ to multithread [Follow the codingo interlace repo instructions]

# git clone https://github.com/codingo/Interlace.git & install accordingly.

Install nucleiΒ @projectdiscovery

# GO111MODULE=on go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei

Β Install lolcat

# apt install lolcat -y

. Install anew

# GO111MODULE=on go get -u github.com/tomnomnom/anew

Usage

You can use this command to check help:

$ bash karma_v2 -h

MODEs

MODEExamples
-ipbash karma_v2 -d <DOMAIN.TLD> -l <INTEGER> -ip
-asnbash karma_v2 -d <DOMAIN.TLD> -l <INTEGER> -asn
-cvebash karma_v2 -d <DOMAIN.TLD> -l <INTEGER> -cve
-faviconbash karma_v2 -d <DOMAIN.TLD> -l <INTEGER> -favicon
-leaksbash karma_v2 -d <DOMAIN.TLD> -l <INTEGER> -leaks
-deepbash karma_v2 -d <DOMAIN.TLD> -l <INTEGER> -deep
-countbash karma_v2 -d <DOMAIN.TLD> -l <INTEGER> -count

Output

output/bugcrowd.com-YYYY-MM-DD/
.
β”œβ”€β”€ ASNs_Detailed_bugcrowd.com.txt
β”œβ”€β”€ Collect
β”‚ β”œβ”€β”€ host_domain_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_12289a814…83029f8944b6088d60204a92e_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_17537bf84…73cb1d684a495db7ea5aa611b_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_198d6d4ec…681b77585190078b07b37c5e1_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_26a9c5618…d60eae2947b42263e154d203f_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_3da3825a2…3b852a42470410183adc3b9ee_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_4d0eab730…68cf11d2db94cc2454c906532_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_8907dab4c…12fdbdd6c445a4a8152f6b7b7_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_9a9b99eba…5dc5106cea745a591bf96b044_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_a7c14d201…b6fd4bc4e95ab2897e6a0bsfd_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_SHA1_a90f4ddb0…85780bdb06de83fefdc8a612d_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_domain_domain.tld.json.gz
β”‚ β”œβ”€β”€ ssl_subjectCN_domain.tld.json.gz
β”‚ └── ssl_subject_domain.tld.json.gz
| └── . . .
β”œβ”€β”€ IP_VULNS
β”‚ β”œβ”€β”€ 104.x.x.x.json.gz
β”‚ β”œβ”€β”€ 107.x.x.x.json.gz
β”‚ β”œβ”€β”€ 107.x.x.x.json.gz
β”‚ └── 99.x.x.x.json.gz
| └── . . .
β”œβ”€β”€ favicons_domain.tld.txt
β”œβ”€β”€ host_enum_domain.tld.txt
β”œβ”€β”€ ips_inscope_domain.tld.txt
β”œβ”€β”€ main_domain.tld.data
β”œβ”€β”€ . . .

karma_v2 Newly Added Shodan Dorks

πš”πšŠπš›πš–πšŠ 𝚟𝟸 Supported Shodan Dorks

DORKsDORKsDORKs
ssl.cert.fingerprinthttp.status:"302" oauth"Server: Jetty"
sslhttp.status:"302" ssoX-Amz-Bucket-Region
orgtitle:"401 Authorization Required""development" org:"Amazon.com"
hostnamehttp.html:"403 Forbidden""X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Jenkins [Jenkins]"
ssl.cert.issuer.cnhttp.html:"500 Internal Server Error"http.favicon.hash:81586312 200
ssl.cert.subject.cnssl.cert.subject.cn:*vpn*product:"Kubernetes" port:"10250, 2379"
ssl.cert.expired:truetitle:"citrix gateway"port:"9100" http.title:"Node Exporter"
ssl.cert.subject.commonNamehttp.html:"JFrog"http.title:"Grafana"
http.title:"Index of /""X-Jfrog"http.title:"RabbitMQ"
ftp port:"10000"http.title:"dashboard"HTTP/1.1 307 Temporary Redirect "Location: /containers"
"Authentication: disabled" port:445 product:"Samba"http.title:"Openfire Admin Console"http.favicon.hash:1278323681
title:"Login - Adminer"http.title:"control panel""MongoDB Server Information" port:27017 -authentication
http.title:"sign up"http.html:"* The wp-config.php creation script uses this file"port:"9200" all:"elastic indices"
http.title:"LogIn"clockwork"220" "230 Login successful." port:21
port:"11211" product:"Memcached""port: 53" Recursion: Enabledtitle:"kibana"
port:9090 http.title:"Prometheus Time Series Collection and Processing Server""default password"title:protected
http.component:Moodlehttp.favicon.hash:116323821html:"/login/?next=" title:"Django"
html:"/admin/login/?next=" title:"Django"title:"system dashboard" html:jirahttp.component:ruby port:3000
html:"secret_key_base"I will add more soon. . .

πš”πšŠπš›πš–πšŠ 𝚟𝟸 Newly Added Shodan Dorks

DORKsDORKsDORKs
"netweaver"port:"2379" product:"etcd"http.title:"DisallowedHost"
ssl:"${target}" "-AkamaiGHost" "-GHost"ssl:"${target}" "-Cloudflare"ssl:"${target}" "-Cloudfront"
"X-Debug-Token-Link" port:443http.title:"shipyard" HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 5664http.title:"TIBCO Jaspersoft:" port:"443" "1970"
"Confluence"http.title:"SonarQube"html:"jmx?qry=Hadoop:*"
http.title:"Directory Listing"http.title:"H-SPHERE"http.title:"Swagger UI - "
Server: Apache-Coyote/1.1 Tomcat-5.5"port:2375 product:"Docker"http.title:"phpinfo()"
http.title:"ID_VC_Welcome""x-powered-by" "jboss"jboss http.favicon.hash:-656811182
http.title:"Welcome to JBoss"port:"8089, 8000" "splunkd"http.favicon.hash:-316785925
title:"splunkd" org:"Amazon.com"http.title:"oracle business intelligence sign in"http.title:"Oracle WebLogic Server Administration Console"
http.title:"Apache Status"I will add more soon. . .
Download
Exit mobile version