Вот написал фронтенд к Nikto, может, кому-нибудь понадобится. Представляет собой консольный графический интерфейс в виде пошагового мастера. Включает все опции Nikto. Нужно сделать файл исполняемым и поместить его в директорию с программой. Приветствуются отзывы и предложения. ################################################## #!/bin/bash # # niktoFE - Copyright (C) 2007 Un_0 <[email protected]> #=========================================================================================================== #DIALOG=Xdialog DIALOG=dialog #=========================================================================================================== nikto='./nikto.pl' port=80 #=========================================================================================================== # $DIALOG --backtitle 'NiktoFE by Un_0' --inputbox 'Host:' 0 0 2> /tmp/host.$$ rval=$? # clear if [ "$rval" = "0" ]; then host=`cat /tmp/host.$$` rm -f /tmp/host.$$ # #=========================================================================================================== # $DIALOG --backtitle 'NiktoFE by Un_0' \ --checklist 'Options' 0 0 0 '1' 'print cookies found' 0 '2' 'find http(s) ports only, do not perform a full scan' 0 '3' 'force full (generic) scan' 0 '4' 'skip name lookup' 0 '5' 'force ssl mode on port' 0 '6' 'use the proxy defined in config.txt' 0 2> /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then options=`cat /tmp/options.tmp.$$` grep -q 1 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then cookies="--cookies" fi grep -q 2 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then findonly="--findonly" fi grep -q 3 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then generic="--generic" fi grep -q 4 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then nolookup="--nolookup" fi grep -q 5 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then ssl="--ssl" fi grep -q 6 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then proxy="-useproxy" fi rm -f /tmp/options.tmp.$$ d=`date | grep -o -h -E '[0-9]{1,2}[:][0-9]{1,2}[:][0-9]{1,2}'` v=`$nikto -V | grep "Nikto main" | grep -o -h -E '[1-9][.][0-9]{1,4}'` $DIALOG --backtitle 'NiktoFE by Un_0' \ --checklist 'Other options' 0 0 0 '1' 'Scan these CGI dirs: ''none'', ''all'', or a value like ''/cgi/''...' 0 '2' 'ids evasion technique...' 0 '3' 'host authentication to use, format is useridassword...' 0 '4' 'port to use (default 80)...' 0 '5' 'prepend root value to all requests, format is /directory...' 0 '6' 'mutate checks...' 0 '7' 'write output to file...' 0 2> /tmp/options.tmp.$$ grep -q 1 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then $DIALOG --inputbox 'Scan these CGI dirs: ''none'', ''all'', or a value like ''/cgi/''' 0 0 all 2>/tmp/dir.$$ dir="-Cgidirs "`cat /tmp/dir.$$` rm -f /tmp/dir.$$ fi grep -q 2 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then $DIALOG --inputbox 'IDS Evasion Techniques: \n 1 Random URI encoding (non-UTF8) \n 2 Directory self-reference (/./) \n 3 Premature URL ending \n 4 Prepend long random string \n 5 Fake parameter \n 6 TAB as request spacer \n 7 Random case sensitivity \n 8 Use Windows directory separator (\) \n 9 Session splicing' 0 0 "" 2>/tmp/ids.$$ ids="-evasion "`cat /tmp/ids.$$` rm -f /tmp/ids.$$ fi grep -q 3 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then $DIALOG --inputbox 'host authentication to use, format is useridassword' 0 0 "" 2>/tmp/auth.$$ auth="-id "`cat /tmp/auth.$$` rm -f /tmp/auth.$$ fi grep -q 4 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then $DIALOG --inputbox 'port to use' 0 0 80 2>/tmp/port.$$ port=`cat /tmp/port.$$` rm -f /tmp/port.$$ fi grep -q 5 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then $DIALOG --inputbox 'prepend root value to all requests, format is /directory' 0 0 "" 2>/tmp/r.$$ r="-root "`cat /tmp/r.$$` rm -f /tmp/r.$$ fi grep -q 6 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then $DIALOG --inputbox 'Mutation Techniques: \ 1 Test all files with all root directories \ 2 Guess for password file names \ 3 Enumerate user names via Apache (/~user type requests) \ 4 Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests) \' 10 120 "" 2>/tmp/mutation.$$ mutation="-mutate "`cat /tmp/mutation.$$` rm -f /tmp/mutation.$$ fi grep -q 7 /tmp/options.tmp.$$ retval=$? if [ "$retval" = "0" ]; then $DIALOG --inputbox 'write output to this file' 0 0 "" 2>/tmp/out.$$ out="-output "`cat /tmp/out.$$` rm -f /tmp/out.$$ fi $DIALOG --backtitle 'NiktoFE by Un_0' \ --msgbox " + Nikto $v - www.cirt.net \n\ + Target IP: $host \n\ + Target Port: $port \n\ + Start Time: $d" 0 0 retval=$? if [ "$retval" = "0" ]; then $DIALOG --backtitle 'NiktoFE by Un_0' \ --infobox "Please wait..." 5 20 & $nikto --host $host $port $proxy $cookies $findonly $generic $nolookup $ssl $r $mutation $dir $ids $auth $out > /tmp/nikto.$$ $DIALOG --textbox /tmp/nikto.$$ 0 0 fi fi fi #=========================================================================================================== rm -f /tmp/nikto.$$ # clear #=========================================================================================================== ##################################################
Gh0s7 Ну это не гуи, это фронт-энд, псевдо-графика. Весьма удобно, по крайней мере, для ознакомления.
Чтобы заменить консоль на ГУИ, нужно закомментировать DIALOG=dialog и расскомментировать #DIALOG=Xdialog. Хотя консоль лучше. Кстати, написал я скрипт, потому что надоело километры команд вводить. А так хоть побыстрее.
