Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/r0x4r/garud

An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically.
https://github.com/r0x4r/garud

assetfinder bash-script bugbounty bugbounty-tool bugbountytips garud gf-patterns golang penetration-testing penetration-testing-tools reconnaissance subdomain-takeover vulnerability vulnerability-scanner

Last synced: 8 days ago
JSON representation

An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically.

Host: GitHub
URL: https://github.com/r0x4r/garud
Owner: R0X4R
License: mit
Created: 2020-09-18T10:21:14.000Z (about 4 years ago)
Default Branch: master
Last Pushed: 2023-07-04T10:29:46.000Z (over 1 year ago)
Last Synced: 2024-10-16T17:39:06.952Z (about 1 month ago)
Topics: assetfinder, bash-script, bugbounty, bugbounty-tool, bugbountytips, garud, gf-patterns, golang, penetration-testing, penetration-testing-tools, reconnaissance, subdomain-takeover, vulnerability, vulnerability-scanner
Language: Shell
Homepage:
Size: 3.36 MB
Stars: 776
Watchers: 17
Forks: 176
Open Issues: 6
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE

Awesome Lists containing this project

README

        


  


  



                                                                                                                                            

An automation tool that scans sub-domains, sub-domain takeover and then filters out xss, ssti, ssrf and more injection point parameters.




















---

I made this tool to automate my recon and save my time. It really give me headache always type such command and then wait to complete one command and I type other command. So I collected some of the tools which is widely used in the bugbounty field. In this script I used Assetfinder, subfinder, amass, httpx, sublister, gauplus and gf patterns and then it uses dirsearch, dalfox, nuclei and kxss to find some low-hanging fruits.
 

The script first enumerates all the subdomains of the give target domain using assetfinder, sublister, subfinder and amass then filters all live domains from the whole subdomain list then it extarct titles of the subdomains using httpx then it scans for subdomain takeover using nuclei. Then it uses gauplus to extract paramters of the given subdomains then it use gf patterns to filters xss, ssti, ssrf, sqli params from that given subdomains and then it scans for low hanging fruits as well. Then it'll save all the output in a text file like target-xss.txt. Then it will send the notifications about the scan using notify. 


```txt

What's new in v4.0: fixed some previous issues and filter out time waste vulns(you need to find them manually) and added dorking.

```

How garud works










Installation


**Requirements:** ``Go Language`` and ``Python 3``.


**System requirements:** Recommended to run on vps with ``1VCPU`` and ``2GB RAM``.


**Tools used - You must need to install these tools to use this script**


  `subfinder` •

  `sublist3r` •

  `gf patterns` •

  `dnsx` •

  `assetfinder` •

  `httpx` •

  `kxss` •

  `nuclei` •

  `dalfox` •

  `anew` •

  `notify` •

  `aquatone` •

  `amass` •

  `gau` •

  `crlfuzz` •

  `uro` •

  `ffuf` •

  `naabu` •

  `crobat` •

  `gobuster` •

  `gospider` •

  `waybackurls`


```bash

#Make sure you're root before installing the tool

garud:~ sudo su

garud:~ apt install git

garud:~ git clone https://github.com/R0X4R/Garud.git && cd Garud/ && chmod +x garud install.sh && mv garud /usr/bin/ && ./install.sh

```

> **Note**: If you encounter any-issue while running `install.sh` file or `garud` run `sed -i -e 's/\r$//' install.sh`

Usage


```js 

                █▀▀▀ █▀▀█ █▀▀█ █░░█ █▀▀▄

                █░▀█ █▄▄█ █▄▄▀ █░░█ █░░█

                ▀▀▀▀ ▀░░▀ ▀░▀▀ ░▀▀▀ ▀▀▀░

[GARUD] == A RECONNAISSANCE SUITE FOR BUG BOUNTY (@R0X4R)

Example Usage:

garud [-d target.tld] [-x exclude domains] [--json] [-s]

Flags:

   -d, --domain                 string     Add your target                         -d target.tld

   -x, --exclude                string     Exclude out of scope domains            -x /home/dommains.list

Optional Flags:

   -s, --silent                            Hide output in the terminal             Default: False

   -j, --json                              Store output in a single json file      Default: False

   -v, --version                           Print current version of Garud

```

**Fix errors while using or installing Garud**

    

```bash

garud:~ chmod +x install.sh && ./install.sh

Error: ./install.sh : /bin/bash^M : bad interpretor: No such file or directory

                                                    

# fix

garud:~ sed -i -e 's/\r$//' install.sh

```

You can also copy the error and search on google this will make your debugging skills better ;)

**Example Usage**

```txt

# garud -d hackerone.com

```

Exclude out of scope domains

```txt

# echo test.hackerone.com > ossdomain.txt

# garud -d hackerone.com -x ~/ossdomain.txt

```

With all flags

```txt

# garud -d hackerone.com -j -s -x /home/oss.txt

```

Hide output in the terminal

```txt

# garud -d hackerone.com -s

```

Store output in a single `json` file

```txt

# garud -d hackerone.com -s -j

# cd hackerone

# cat output.json | jq

{

  "nuclei_critical": [],

  "vuln_crlf": [],

  "dalfox": [

    "[POC][V][GET][inATTR-double(3)-URL] http://subdomain.target.tld/hpp?pp=FUZZ%22onpointerout%3Dconfirm.call%28null%2C1%29+class%3Ddalfox+",

    ----------------------snip----------------------

    "subdomains": [

      "sub.target.tld",

      "tub.target.tld",

      "subdomain.target.tld"

  ],

  "vuln_xss": [

    "[POTENTIAL XSS] - http://subdomain.target.tld/hpp/?pp=%22%3E%2F%3E%3Csvg%2Fonload%3Dconfirm%28document.domain%29%3E ",

    "[POTENTIAL XSS] - http://subdomain.target.tld:80/hpp/?pp=%22%3E%2F%3E%3Csvg%2Fonload%3Dconfirm%28document.domain%29%3E ",

    "[POTENTIAL XSS] - http://subdomain.target.tld:80/hpp/index.php?pp=%22%3E%2F%3E%3Csvg%2Fonload%3Dconfirm%28document.domain%29%3E "

  ]

}

```

**Docker**

Contributed by [`@frost19k`](https://github.com/frost19k)

This image needs to be built with [`Buildkit`](https://docs.docker.com/develop/develop-images/build_enhancements/)

```bash

garud:~ git clone https://github.com/R0X4R/Garud.git

garud:~ cd Garud 

garud:~ docker buildx build -t garud -f Dockerfile .

```

To run the container

```bash

garud:~ docker run -t --rm \

  -v "/path/on/host":"/output" \   # Mount the Host Output Folder to "/output"

  -v "/path/to/configs":"/Garud/.config/notify" \   # Mount your Notify Config files to "/Garud/.config/notify"

  garud -d hackerone.com

```

Garud runs as root inside the container & so it is advisable to configure Linux Namespaces 

1. [Isolate containers with a user namespace](https://docs.docker.com/engine/security/userns-remap/)

2. [Use Linux user namespaces to fix permissions in docker volumes](https://www.jujens.eu/posts/en/2017/Jul/02/docker-userns-remap/)

Notifications


[`@slack`](https://slack.com/intl/en-it/help/articles/115005265063-Incoming-webhooks-for-Slack) •

[`@discord`](https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks) •

[`@telegram`](https://core.telegram.org/bots#3-how-do-i-create-a-bot) •

[`configure-notify`](https://github.com/projectdiscovery/notify#config-file)

                                                                



Donate
 

|[`buymeacoffee.com/R0X4R`](https://www.buymeacoffee.com/R0X4R)|[`payU India`](https://pmny.in/bIKNZngt4ys1)|[`kofi.com/R0X4R`](https://ko-fi.com/i/IK3K34SJSA)|

|--------|--------|------|

### Thanks to the authors of the tools used in this script.

[`@aboul3la`](https://github.com/aboul3la) [`@tomnomnom`](https://github.com/tomnomnom) [`@lc`](https://github.com/lc) [`@hahwul`](https://github.com/hahwul) [`@projectdiscovery`](https://github.com/projectdiscovery) [`@maurosoria`](https://github.com/maurosoria) [`@shelld3v`](https://github.com/shelld3v) [`@devanshbatham`](https://github.com/devanshbatham) [`@michenriksen`](https://github.com/michenriksen) [`@defparam`](https://github.com/defparam/) [`@projectdiscovery`](https://github.com/projectdiscovery) [`@bp0lr`](https://github.com/bp0lr/) [`@ameenmaali`](https://github.com/ameenmaali) [`@dwisiswant0`](https://github.com/dwisiswant0) [`@OWASP`](https://github.com/OWASP/) [`@1ndianl33t`](https://github.com/1ndianl33t) [`@sqlmapproject`](https://github.com/sqlmapproject) [`@w9w`](https://github.com/w9w) [`@OJ`](https://github.com/OJ) [`@jaeles-project`](https://github.com/jaeles-project) [`@s0md3v`](https://github.com/s0md3v) [`@ffuf`](https://github.com/ffuf)

Thanks to all the contributors [`contributors.md`](.github/contributors.md)

**Warning:** This code was originally created for personal use, it generates a substantial amount of traffic, please use with caution.