Divide
Et Impera
And Scan (and also merge the scan results)
DivideAndScan is used to efficiently automate port scanning routine by splitting it into 3 phases:
- Discover open ports for a bunch of targets.
- Run Nmap individually for each target with version grabbing and NSE actions.
- Merge the results into a single Nmap report (different formats available).
For the 1st phase a fast port scanner is intended to be used (Masscan / RustScan), whose output is parsed and stored in a database (TinyDB). Next, during the 2nd phase individual Nmap scans are launched for each target with its set of open ports (multiprocessing is supported) according to the database data. Finally, in the 3rd phase separate Nmap outputs are merged into a single report in different formats (XML / HTML / Simple text / Grepable) with nMap_Merger.
Potential use cases:
- Pentest engagements / red teaming with a large scope to enumerate.
- Cybersecurity wargames / training CTF labs.
- OSCP certification exam.
How It Works
How to Install
Prerequisites
To successfully divide and scan we need to get some good port scanning tools.
Nmap
sudo apt install nmap sudo xsltproc -y
sudo nmap --script-updatedb
Masscan
cd /tmp
git clone https://github.com/robertdavidgraham/masscan.git
cd masscan
make
sudo make install
cd && rm -rf /tmp/masscan
RustScan
cd /tmp
wget -qO- https://api.github.com/repos/RustScan/RustScan/releases/latest \
| grep "browser_download_url.*amd64.deb" \
| cut -d: -f2,3 \
| tr -d \" \
| wget -qO rustscan.deb -i-
sudo dpkg -i rustscan.deb
cd && rm /tmp/rustscan.deb
sudo wget https://gist.github.com/snovvcrash/c7f8223cc27154555496a9cbb4650681/raw/a76a2c658370d8b823a8a38a860e4d88051b417e/rustscan-ports-top1000.toml -O /root/.rustscan.toml
Installation
DivideAndScan is available on PyPI as divideandscan, though I recommend installing it from GitHub with pipx in order to always have the bleeding-edge version:
~$ pipx install -f "git+https://github.com/snovvcrash/DivideAndScan.git"
~$ das
For debbugging purposes you can set up a dev environment with poetry:
~$ git clone https://github.com/snovvcrash/DivideAndScan
~$ cd DivideAndScan
~$ poetry install
~$ poetry run das
Using from Docker
You can run DivideAndScan in a Docker container as follows:
~$ docker run -it --rm --name das -v `pwd`:/app snovvcrash/divideandscan
Since the tool requires some input data and produces some output data, you should specify your current working directory as the mount point at /app within the container. You may want to set an alias to make the base command shorter:
~$ alias das='docker run -it --rm --name das -v `pwd`:/app snovvcrash/divideandscan'
~$ das
How to Use
More examples coming soon at snovvcrash.rocks...
0. Preparations
| Make a new directory to start DivideAndScan from. The tool will create subdirectories to store the output, so I recommend launching it from a clean directory to stay organized: ~$ mkdir divideandscan
~$ cd divideandscan
|
1. Filling the DB
| Provide the
# Masscan example
~$ das add -db testdb masscan '--rate 1000 -iL hosts.txt --open -p1-65535'
# RustScan example
~$ das add -db testdb rustscan '-b 1000 -t 2000 -u 5000 -a hosts.txt -r 1-65535 -g --no-config'
When the module completes its work, a hidden directory |
2. Targeted Scanning
| Launch targeted Nmap scans with the # Scan by hosts
~$ das scan -db testdb -hosts all -oA report1
~$ das scan -db testdb -hosts 192.168.1.0/24,10.10.13.37 -oA report1
~$ das scan -db testdb -hosts hosts.txt -oA report1
# Scan by ports
~$ das scan -db testdb -ports all -oA report2
~$ das scan -db testdb -ports 22,80,443,445 -oA report2
~$ das scan -db testdb -ports ports.txt -oA report2
To start Nmap simultaneously in multiple processes, specify the ~$ das scan -db testdb -hosts all -oA report -parallel [-proc 4]
The output format is selected with Also, you can inspect the contents of the database with ~$ das scan -db testdb -hosts all -show
|
3 (Optional). Merging the Reports
| In order to generate a report independently of the # Merge outputs by hosts
~$ das report -db testdb -hosts all -oA report1
~$ das report -db testdb -hosts 192.168.1.0/24,10.10.13.37 -oA report1
~$ das report -db testdb -hosts hosts.txt -oA report1
# Merge outputs by ports
~$ das report -db testdb -ports all -oA report2
~$ das report -db testdb -ports 22,80,443,445 -oA report2
~$ das report -db testdb -ports ports.txt -oA report2
|
Help
usage: das [-h] {add,scan,report} ...
-----------------------------------------------------------------------------------------------
| ________ .__ .__ .___ _____ .____________ |
| \______ \ |__|__ _|__| __| _/____ / _ \ ____ __| _/ _____/ ____ _____ ____ |
| | | \| \ \/ / |/ __ |/ __ \ / /_\ \ / \ / __ |\_____ \_/ ___\\__ \ / \ |
| | ` \ |\ /| / /_/ \ ___// | \ | \/ /_/ |/ \ \___ / __ \| | \ |
| /_______ /__| \_/ |__\____ |\___ >____|__ /___| /\____ /_______ /\___ >____ /___| / |
| \/ \/ \/ \/ \/ \/ \/ \/ \/ \/ |
| {@snovvcrash} {https://github.com/snovvcrash/DivideAndScan} {vX.Y.Z} |
-----------------------------------------------------------------------------------------------
positional arguments:
{add,scan,report}
add run a full port scan {masscan,rustscan} and add the output to DB
scan run targeted Nmap scans against hosts and ports from DB
report merge separate Nmap outputs into a single report in different formats
optional arguments:
-h, --help show this help message and exit
Psst, hey buddy... Wanna do some organized p0r7 5c4nn1n6?
ToDo
- Add projectdiscovery/naabu parser
- Add armada scanner (?) parser
Support
If this tool has been useful for you, feel free to buy me a
beer
coffee!
299 Dec 24, 2022
276 Mar 3, 2021
2 Aug 12, 2021
1 Dec 26, 2021
909 Dec 15, 2022
3.3k Jan 5, 2023
160 Jul 25, 2022
382 Dec 27, 2022
14 Dec 6, 2022
![Runtime error FileNotFoundError: [Errno 2] No such file or directory: '/root/.das/db/main.json'](https://avatars.githubusercontent.com/u/85784596?v=4)
2 Jan 2, 2022
1 Jun 20, 2022
70 Jan 3, 2023
3.5k Dec 30, 2022
9 May 8, 2022
548 Dec 28, 2022
64 Dec 12, 2022
6.4k Jan 5, 2023
56 Oct 29, 2022