lazyrecon_docker - GitLite

KO | EN

gitlite — search

#python #typescript #llm #golang #go #android #machine-learning #deep-learning #linux #docker #awesome #kubernetes #vue #pytorch

lazyrecon_docker

(★ 50)

Containerized version of my fork of Nahamsec's Lazyrecon.

파일 탐색기

최종 버전 다운로드 (.zip)

- - semgrep.yml
- dependabot.yml
- .gitignore
- run_no_args.sh
.dockerignore
.gitignore
docker-compose.yml
Dockerfile
lazyrecon.sh
LICENSE
README.md
recon.gif
report.gif
run.bat
run.sh

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/soaringswine/lazyrecon_docker

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd lazyrecon_docker

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

3) docker build --rm -f "Dockerfile" -t lazyrecon_docker:latest .

Dockerfile을 기반으로 실행 가능한 이미지를 빌드합니다.

4) docker run --user $(id -u):$(id -g) -v $(pwd)/lazyrecon_results:/home/lazyrecon_user/tools/lazyrecon/lazyrecon_results/ lazyrecon_docker -d DOMAIN.TLD

빌드된 이미지를 실제 컨테이너로 실행합니다.

5) Results will be stored in ./lazyrecon_results on Docker host

이 명령어를 터미널에 그대로 입력해 실행하세요.

1) docker run --user $(id -u):$(id -g) -v $(pwd)/lazyrecon_results:/home/lazyrecon_user/tools/lazyrecon/lazyrecon_results/ soaringswine/lazyrecon_docker -d DOMAIN.TLD

빌드된 이미지를 실제 컨테이너로 실행합니다.

2) Results will be stored in ./lazyrecon_results on Docker host

이 명령어를 터미널에 그대로 입력해 실행하세요.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# lazyrecon_docker
Containerized version of my fork of Nahamsec's Lazyrecon.

I'm sure I can optimize the build process and I'm willing to bet I'm not following best practices.

# How to run
```
Build locally:
1) git clone https://github.com/soaringswine/lazyrecon_docker.git
2) cd lazyrecon_docker
3) docker build --rm -f "Dockerfile" -t lazyrecon_docker:latest .
4) docker run --user $(id -u):$(id -g) -v $(pwd)/lazyrecon_results:/home/lazyrecon_user/tools/lazyrecon/lazyrecon_results/ lazyrecon_docker -d DOMAIN.TLD
5) Results will be stored in ./lazyrecon_results on Docker host
6) ???
7) Hopefully profit?!

From Dockerhub:
1) docker run --user $(id -u):$(id -g) -v $(pwd)/lazyrecon_results:/home/lazyrecon_user/tools/lazyrecon/lazyrecon_results/ soaringswine/lazyrecon_docker -d DOMAIN.TLD
2) Results will be stored in ./lazyrecon_results on Docker host
3) ???
4) Hopefully profit (but faster)?!

With docker-compose (Codex AI insisted on sharing this wisdom):
1) Export UID and GID so the container doesn't freak out
2) UID=$(id -u) GID=$(id -g) docker-compose up
3) Your loot appears in ./lazyrecon_results on the host
```

# soaringswine's Lazyrecon fork
soaringswine: I've added amass, Project Sonar (old data but someone graciously is hosting a script to let you query it nicely!), pdlist, and dnsgen into the mix and expanded the nmap and Aquatone port scanning. There were some issues with how cat and sort were being used that would leave the $domain.txt file blank, so I fixed those. Also removed one of the $domain.txt cats that was undoing the wildcard dupe pruning and added some echos to help understand what's going on in different stages. Fixed some other misc. things and tidied up the code a tad.

```
  _     ____  ____ ___  _ ____  _____ ____ ____  _
 / \   /  _ \/_   \\  \///  __\/  __//   _Y  _ \/ \  /|
 | |   | / \| /   / \  / |  \/||  \  |  / | / \|| |\ ||
 | |_/\| |-||/   /_ / /  |    /|  /_ |  \_| \_/|| | \||
 \____/\_/ \|\____//_/   \_/\_\\____\\____|____/\_/  \|

```

# Usage

`./lazyrecon.sh -d target.com`

# About

LazyRecon is a script written in Bash, it is intended to automate some tedious tasks of reconnaissance and information gathering.
This tool allows you to gather some information that should help you identify what to do next and where to look.

# Main Features 
- Create a dated folder with recon notes
- Grab subdomains using:

* Sublist3r, certspotter and cert.sh
      * Dns bruteforcing using massdns
      
- Find any CNAME records pointing to unused cloud services like aws
- Probe for live hosts over ports 80/443
- Grab a screenshots of responsive hosts 
- Scrape wayback for data:

* Extract javascript files
      * Build custom parameter wordlist, ready to be loaded later into Burp intruder or any other tool
      * Extract any urls with .jsp, .php or .aspx and store them for further inspection
      
- Perform nmap on specific ports 
- Get dns information about every subdomain
- Perform dirsearch for all subdomains 
- Generate a HTML report with output from the tools above
- Improved reporting and less output while doing the work
- Dark mode for html reports

# New features
- Directory search module is now MULTITHREADED (up to 10 subdomains scanned at a time)
- Enhanced html reports with the ability to search for strings, endpoints, response sizes or status codes

# DEMO
![cli output](https://github.com/plenumlab/lazyrecon/raw/dev/upgrade/recon.gif)
=================================================================================
![report demo](https://github.com/plenumlab/lazyrecon/raw/dev/upgrade/report.gif)

# Installation & Requirements
- Download the install script from https://github.com/nahamsec/bbht.
- Go version 1.10 or later.

### System Requirements
- Recommended to run on vps with 1VCPU and 2GB ram.

# Authors and Thanks
This script makes use of tools developed by the following people
- [Tom Hudson - Tomonomnom](https://github.com/tomnomnom)
- [Ahmed Aboul-Ela - Aboul3la](https://github.com/aboul3la)
- [B. Blechschmidt - Blechschmidt](https://github.com/blechschmidt)
- [Thomas D. - Maaaaz](https://github.com/maaaaz)
- [Daniel Miessler - Danielmiessler](https://github.com/danielmiessler)

# TO DO
- Report only mode to generate reports for old dirsearch data
- SubDomain exclusion

## Running tests
Run `bash tests/run_no_args.sh` to verify that `run.sh` handles missing arguments correctly.

**Warning:** This code was originally created for personal use, it generates a substantial amount of traffic, please use with caution.

## License
This project is licensed under the [MIT License](LICENSE).