Need help with EchoPwn?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

hackerspider1
176 Stars 54 Forks 3 Commits 0 Opened issues

Description

Recon Automation for hackers by hackers

Services available

!
?

Need anything else?

Contributors list

No Data

EchoPwn

Buy Me A Coffee

This is a recon tool which allows you to discover the subdomains used by a target web application on both client and server side. Afterwards, it runs dirsearch on the resulted text file. It can also scan for open ports using NMAP and finds hidden parameters on every live Host.

EchoPwn

For installation steps Please refer to this link.

Usage

Usage: ./EchoPwn.sh [options] -d domain.com
Options:
    -h            Display this help message.
    -k            Run Knockpy on the domain.
    -n            Run Nmap on all subdomains found.
    -a            Run Arjun on all subdomains found.
    -p            Run Photon crawler on all subdomains found.
    -b            Run Custom Bruteforcer to find subdoamins.

Target: -d Specify the domain to scan.

Example: ./EchoPwn.sh -d hackerone.com

Output will be saved in EchoPwn/domain.com/ directory

EchoPwn.gif

Workflow:

install.sh
makes environment to run
EchoPwn.sh
EchoPwn.sh
creates a directory
EchoPwn/domain_name
in current working directory. 1. Subdomain Enumeration - Sublist3r - crt.sh - amass - subfinder - assetfinder - aquatone-discover - findomain - github-subdomains - custom bruteforcer with
subdomains.txt
as input file. - Optional: knockpy
  1. Checking for live subdomains

    • httprobe
  2. Screenshots

    • aquatone
  3. Directory Bruteforce

    • dirsearch
  4. Optional

    • -n [Nmap]     Probe open ports to determine service/version info
    • -a [Arjun]      Scans for hidden parameters on live hosts
    • -p [Proton]    Crawls all live hosts [takes time and creates lots of files]
    • -b [Custom Bruteforcer]    Runs custom bruteforcer to find subdomains
    • -k [KnockPy]     Bruteforce subdomains [takes time and saves output in current working directory (in json format)]
  5. Checking for subdomain takeover

    • Subdomain-takeover
  6. Slack Notification

    • WebHook URL placed in
      tokens.txt
      will be used to notify the user once the script has finished running.

Slack

Final list of subdomains will be present in

EchoPwn/domain_name
directory. Outputs corresponding to the tools will also be present in the same directory.

Installation and Requirements:

Only for MacOS and Linux

Prerequisites
  1. go
  2. gem

Then run:

./install.sh
Some Tools require manual downloading of pre-built binaries (or build them yourself): 1. Subfinder 2. Assestfinder 3. Aquatone

Download (or build) and place these binaries in the

EchoPwn
directory.

Apart from the tokens required by individual tools, this script requires 4 additional values: - FaceBook Token - Github Token - Spyse Token - VirusTotal Token - Slack WebHook URL

Place these values in

tokens.txt
before running
EchoPwn.sh

NOTE 1. If you face Import error (Queue) while running altdns, you have to manually change main.py file mentioned in the error. Do the following change Before:

Import Queue from Queue as Queue
After:
Import queue from Queue as Queue
  1. To set GOPATH, use the following command:
    export $GOPATH=~/go/bin

Suggestions are welcomed. Mail us at: [email protected]

Thanks

This script uses tools which are developed by the following people

OWASP, ProjectDiscovery, Tom Hudson, Michael Henriksen, Gwendal Le Coguic, Eduard Tolosa, B. Blechschmidt, ProjectAnte, Somdev Sangwan, Mauro Soria, Gianni Amato, Ahmed Aboul-Ela, 0x94

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.