lazyrecon exploit

### ![](

Lazyrecon is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and is optimized for speed while working with github and wayback machine.

* Domain name, list of domains, IP, CIDR input - notations support

This script is intended to automate your reconnaissance process in an organized fashion by performing the following:

* Creates a dated folder with recon notes for a target

* Grabs subdomains using `subfinder`, `assetfinder`, `gau`, `waybackurls`, `github-subdomains`

* Additionally finds new subdomains through alterations and permutations using `dnsgen`

* Searches subnets and new assets using math `Mode`

* Filters out live subdomains from a list of hosts using `shuffledns`

* Checks 1-200,8000-10000 for http(s) probes using `httpx`

* Gets visual part using `headless chromium`

* Scanns for known paths and CVEs using `nuclei`

* Shots for SSRF/LFI/SQLi based on wayback machine's data

* Checks for potential request smuggling vulnerabilities using `smuggler`

* Performs `ffuf` supercharged by `interlace` using custom WordList based on the top10000.txt

* Generates report and send it to Discord

The point is to get a list of live IPs (in form of socket addresses), attack available network protocols, check for common CVEs, perform very simple directory bruteforce then use provided reports for manual research.

You can use stateful/stateless build agent (worker). There is no additional time is required for provisioning. It may look tricky cause masscan/nmap/naabu root user required.

1. Fill in these required environment variables inside: `./lazyconfig`:

access token here export DISCORDWEBHOOKURL= # export GOPATH=$HOMEDIR/go export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin:$GOROOT/bin:$ /.local/bin:$ /go/bin:$HOMEDIR/go/bin export GO111MODULE=on ">

export HOMEUSER= # your normal, non root user: e.g.: kali

export HOMEDIR= # user's dir e.g.: / /kali

export STORAGEDIR= # where output saved, e.g.: ${HOMEDIR}/lazytargets

export GITHUBTOKEN=XXXXXXXXXXXXXXXXXX # a personal access token here

export DISCORDWEBHOOKURL= #

export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin:$GOROOT/bin:$ /.local/bin:$ /go/bin:$HOMEDIR/go/bin

2. Enable new environment `source ./lazyconfig`

4. Execute `sudo -E ./lazyrecon.sh "hackerone.com"`

Customize `.github/workflows/test-recon-action.yaml` using `DISCORDWEBHOOKURL` and `GITHUBTOKEN` secrets, enable `--discord` to receive a report:

DISCORDWEBHOOKURL: ${{ secrets.DISCORDWEBHOOKURL }}

export STORAGEDIR="${HOMEDIR}"/lazytargets

sudo -E ./lazyrecon.sh "hackerone.com" --quiet --discord

Config your environment variables and dependencies using INSTALL.MD

If you faced with some issues, feel free to join Discord, open PR or file the bug.

Execute with `sudo` because of `masscan`:

â–¶ sudo -E ./lazyrecon.sh tesla.com --wildcard

**Parameter** | **Description** | **Example**

\--wildcard | Subdomains reconnaissance '*.tesla.com' (default) | ./lazyrecon.sh tesla.com --wildcard

\--single | One target instance 'tesla.com' | ./lazyrecon.sh tesla.com --single

\--ip | Single IP of the target machine | ./lazyrecon.sh 192.168.0.1 --single --ip

\--list | List of subdomains to process for | ./lazyrecon.sh "./testa.txt" --list

\--cidr | Perform network recon, CIDR notation | ./lazyrecon.sh "192.168.0.0/16" --cidr

\--mad | Wayback machine's stuff | ./lazyrecon.sh tesla.com --mad

\--fuzz | SSRF/LFI/SQLi fuzzing | ./lazyrecon.sh tesla.com --mad --fuzz

\--alt | Additionally permutate subdomains (*.tesla.com only) | ./lazyrecon.sh tesla.com --wildcard --alt

\--brute | Basic directory bruteforce (time sensitive) | ./lazyrecon.sh tesla.com --single --brute

\--discord | Send notifications to discord | ./lazyrecon.sh tesla.com --discord

\--quiet | Enable quiet mode | ./lazyrecon.sh tesla.com --quiet

0. Use dnsperftest to know your best resolvers

2. Check output reports of chromium, nuclei, masscan, server_log, ssrf, lfi

4. Perform Google, Trello, Atlassian, Github, Bitbucket dorking

5. Check JS sources for credentials, API endpoints

6. Investigate `XHR` requests, fuzz parameters and variables

7. Check exploit-db.com for target-specific CVE

8. GET/POST Bruteforce for directories: fuzbo0oM-top10000 --> raft --> target specific

9. Continue bruteforcing using custom Headers (X-Custom-IP-Authorization: 127.0.0.1; X-Original-URL:)

10. Try bypass 401/403 errors using notable methods (`%23`, `/%2e/`, `admin.php%2500.md` etc)

This project was inspired by original v1.0 Ben Sadeghipour and aimed to implement some of the best practices like Mechanizing the Methodology, TBHM, Subdomain Takeovers, Request Smuggling, SSRF, LFI and Bruteforce based on Custom wordlist.

1. IDOR:

2. SSRF: and

* `aquatone` replaced by headless chromium async script based on performance

* `Sublist3r` replaced with `subfinder` based on Twitter discussion

* `nmap` replaced with `masscan` based on its features and Twitter duscussion, use `helpers/nmap_nse_ifile.sh` by hands using `masscan_output.gnmap` as input

* `smuggler` forked from its original aimed to get lightweight solution included this PR

* ~~`grep` `meg`'s output for Location in order to exclude 301/302 status codes~~ (replaced with `httpx -fc 301,302` approach)

* ~~`httpx -ip` used without `dnsprobe` based on @pdiscoveryio Twitter answer~~

* `altdns` used based on Scrutiny on the bug bounty

* `massdns` fully replaced with `shuffledns` because of issue

* local listen server approach replaced with interactsh

* WIP: you can track activity in Projects To Do board

**Acknowledgement:** This code was created for personal use with hosts you able to hack/explore by any of the known bug bounty program. Use it at your own risk.