{“recon_scripts_v2.0”}

#!/bin/bash

<< comment
This handy recon tool combines a bunch of different methods 
for finding subdomains, directories, and more. It helps you 
get a clear picture of how a web application is set up, 
making it easier to see the whole layout and spot any 
potential issues.

Disclaimer:
This script is intended for educational purposes and authorized security testing only. 
The author is not responsible for any misuse or damage caused by this tool. 
Users are responsible for ensuring they have proper authorization before running 
any security scans. Always verify the scope of your testing to ensure compliance 
with relevant laws and policies.

By using this tool, you agree to use it responsibly and in accordance with all 
applicable laws and regulations. The author disclaims all liability for any actions 
taken based on the information provided by this tool.
comment

#Declare variables
domain=$1
mode=$2
RED="\033[1;31m"
YELLOW="\033[0;33m"
WHITE="\033[0;37m"
RESET="\033[0m"
LINE="\033[0;37m----------------------------------------------------------\033[0m"
basic_path=$domain/basic_recon
service_path=$domain/service_recon
directory_path=$domain/directory_recon
subdomain_path=$domain/subdomain_recon

# Function to display a rotating progress indicator
progress() {
  local pid=$1
  local delay=0.1
  local spinstr='|/-\'
  while ps -p $pid > /dev/null 2>&1; do
    local temp=${spinstr#?}
    printf " [%c]  " "$spinstr"
    local spinstr=$temp${spinstr%"$temp"}
    sleep $delay
    printf "\b\b\b\b\b\b"
  done
  printf "    \b\b\b\b"
}

# TOOL BANNER 
echo -e "${WHITE}
 ___  ___  ___  __  ___  ___    ___   ___   __  __  _  _ 
(  _)(   \(   \(  )(  _)/ __)  (  ,) (  _) / _)/  \( \( )
 ) _) ) ) )) ) ))(  ) _)\__ \   )  \  ) _)( (_( () ))  ( 
(___)(___/(___/(__)(___)(___/  (_)\_)(___) \__)\__/(_)\_)
${RESET}"
echo -e "${LINE}"
sleep 1

#Directory Making
echo "Creating directories for recon : $domain"
sleep 1

## Make top level recon directory
if [ ! -d "$domain" ];then
	mkdir $domain
fi 
if [ ! -d "$basic_path" ];then
	mkdir $basic_path
fi

#Basic Emuneration (whois and nslookup) #Included in every mode
## whois scan
echo "Conducting basic scans ..."
echo "Executing \"whois $domain\""
whois $domain > $basic_path/whois.txt &
pid=$!
progress $pid
wait $pid
echo "[+] whois scan complete"
echo -e "${LINE}"
sleep 1

## nslookup scan 
echo "Executing \"nslookup $domain\""
nslookup $domain > $basic_path/nslookup.txt &
pid=$!
progress $pid
wait $pid
echo "[+] nslookup scan complete"
echo -e "${LINE}"
sleep 1 


#Service Mode 
service_enum(){

  ## Make directory for service enumeration 
  echo -e "Making service enumeration folder"  
  if [ ! -d "$service_path" ];then
  mkdir $service_path
  fi
  
  ## nmap scan -> Feel free to add options to nmap (Sake of testing script I will not)
  echo "Executing \"nmap $domain\" :"
  nmap $domain > $service_path/nmap.txt &
  pid=$!
  progress $pid
  wait $pid
  echo "[+] NMAP Scan completed!"
  echo -e "${LINE}"
  sleep 1
}

#Directory Mode
directory_enum(){

  ## Make directory for directory enumeration 
  echo -e "Making directory enumeration folder"
  if [ ! -d "$directory_path" ];then
    mkdir $directory_path
  fi
  
  ## FFUF tool -> uses medium wordlist
  ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u https://$domain/FUZZ > test.txt&
  pid=$!
  progress $pid
  wait $pid
  echo "[+] FFUF Scan completed!"
  echo -e "${LINE}"
  sleep 1

  ## Dirb tool -> Recursive directory enumeration to domain 
  dirb https://$domain > $directory_path/dirb.txt &
  pid=$!
  progress $pid
  wait $pid
  echo "[+] Dirb Scan completed!"
  echo -e "${LINE}"
  sleep 1
}
 
#Subdomain Mode 
subdomain_enum(){

  ## Make directory for subdomain enumeration 
  echo -e "Making subdomain enumeration folder"
  if [ ! -d "$subdomain_path" ];then 
    mkdir $subdomain_path
  fi

  ##subfinder 
  echo -e "${WHITE} [+] Executing subfinder ... ${RESET}"
  subfinder -d $domain > $subdomain_path/found_subdomain.txt &
  pid=$!
  progress $pid
  wait $pid
  echo "[+] Subfinder Scan completed!"
  echo -e "${LINE}"
  sleep 1

  ##assetfinder 
  echo -e "${WHITE} [+] Executing assetfinder ... ${RESET}"
  assetfinder $domain | grep $domain >> $subdomain_path/found_subdomain.txt &
  pid=$!
  progress $pid
  wait $pid
  echo "[+] Assetfinder Scan completed!"
  echo -e "${LINE}"
  sleep 1

  ##finding alive subdomains (HTTPROBE)
  echo -e "${WHITE} [+] Finding alive subdomains (HTTPROBE) ... ${RESET}" &
  pid=$!
  progress $pid
  wait $pid
  echo "[+] HTTPROBE Scan completed!"
  echo -e "${LINE}"
  sleep 1
  cat $subdomain_path/found_subdomain.txt | grep $domain | sort -u | httprobe -prefer-https | grep https | sed 's/https\?:\/\///' | tee -a $subdomain_path/alive_subdomains.txt

  ##screenshot of alive subdomains (GOWITNESS)
  echo -e "${WHITE} [+] Taking screenshots of alive subdomains (GOWITNESS) ... ${RESET}" 
  gowitness file -f $subdomain_path/found_subdomain.txt -P $screenshot_path/ --no-http &
  pid=$!
  progress $pid
  wait $pid
  echo "[+] Screenshots completed!"
  echo -e "${LINE}"
  sleep 1

}

# Prompt user for mode
echo "What mode would you like to use? (serv for service, dir for directory, sub for subdomain, all for everything)"
read -r mode

# Main logic to handle user input
case "$mode" in
  serv)
    service_enum
    ;;
  dir)
    directory_enum
    ;;
  sub)
    subdomain_enum
    ;;
  all)
    service_enum
    directory_enum
    subdomain_enum
    ;;
  *)
    echo "Invalid option. Please use 'serv' for service, 'dir' for directory, 'sub' for subdomain, 'all' for everything"
    ;;
esac