Why would you use Scant3r?
Scant3r Scans all URLs with multiple HTTP Methods and Tries to look for bugs with basic exploits as XSS - SQLI - RCE - SSTI from Headers and URL Parameters
By chaining waybackurls or gau
with Scant3r you will have more time to look into functions and get Easy bugs on the way :)
Scant3r will give you more time to focus on functionailities We've provided some modules to help you
Module | Description |
---|---|
PMG | dump a intersting parameters from waybackurls |
lorsrf | Bruteforcing on Hidden parameters to find SSRF vulnerability |
headers | inject SSTI - XSS - RCE - SQLI payloads in HTTP Headers |
neon | scans admin panel from CVE-2019-20141 |
Nokia https://www.nokia.com/responsible-disclosure/
$ git clone https://github.com/knassar702/scant3r
$ cd scant3r
$ pip3 install -r requirements.txt
$ git clone https://github.com/knassar702/scant3r
$ cd scant3r
$ docker build scant3r:latest .
$ docker run -it scant3r -h
Usage
- normal scan
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py
- add module
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py -m headers
# note : use -S if you need to use scanner after use modules
- random User-agents
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py -R
- add custom headers
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py -H "Auth: U2NhblQzcgo=\nNew: True"
- add timeout
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py -t 1000
- add threads
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py -w 50
- add http/https proxy
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py -p http://localhost:8080
- add cookies
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py -c 'login=test%2Ftest'
- follow redirects
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py -r
- dump http requests/responses
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py -H "Auth: U2NhblQzcgo=" -d
- remove logo
$ echo "http://testphp.vulnweb.com/search.php?test=query&searchFor=1&goButton=go" | python3 scant3r.py --nologo