English | 简体中文
A comprehensive tool that assists penetration testing projects. It is a flexible, compact and efficient scan tool mainly used for lateral penetration of the intranet. The format of targets can be written by most of the various forms of link or CIDR and add any ports and paths to it.
Core developers
Penetration test only
- python2.7 - python3.x support without and depend
- Passively identify some frameworks, components of the site and over 1000 data of fingerprints
- Passively identify whether the site is on the cloud
- Almost support for import with the arbitrary format
- Using across platforms after compiling by pyinstaller
- Compiling with low-level GLIBC in Linux to be compatible with more kernel versions
- Compiling with python2 on windows to reduce the error of lacking DLL
- Use it in VPS for resolving network problems
- Eliminate the account information when scanning on the intranet
Control the file through --project
- res_alivedomain.txt will save all the report automatically
- folder tree
- result.txt
- focuson.txt
Use the following script to scan if you have many tasks
target.txt
<name of a company> xxx.com
<name of another company> xxx.io
#!/bin/bash
while read line
do
project=`echo $line | awk -F " " '{print $1}'`
host=`echo $line | awk -F " " '{print $2}'`
echo $host,$project
python AlliN.py --host $host -q "(domain=\"$host\" || cert=\"$host\" || title=\"$project\") && country=\"CN\" && region!=\"HK\" && region!=\"TW\" && region!=\"MO\"" -m sfscan --timeout 6 --project $project -t 100
done < target.txtDesignate the domains or hosts
Samples:
--host 10.1.1.1
--host 10.1.1.1-10.2.2.2
--host 10.1.1.1/24 # any CIDR
--host 10.1.1.1-255
--host 2001:db8::/126 # any CIDR
--host [2001:4860:4860::8888]
--host 2001:db8::1-2001:db8::5
--host <arbitrary format of the domain>
Default is 3
--timeout 3
Timeout of pscan, default is 0.5
--ctimeout 0.5
--proxy http://127.0.0.1:8081
--proxy http://user:[email protected]:8801
--proxy socks5://127.0.0.1:1080
--proxy socks5://user:[email protected]:1080
pip install PySocks before using it
Name of scan project, it will create a folder for saving results
Designate the ports
Samples:
-p 80
-p 80,443
-p 8000-9000
-p 80,8000-9000
-p- all of ports
Name of the input file
Samples:
-f iplist.txt
There are many formats of targets, such as
http://www.baidu.com
1.1.1.1/24
www.baidu.com/asd
www.baidu.com:80/123
1.1.1.1/sads
1.1.1.1:8080/123
1.1.1.1-250
1.1.1.1-1.1.1.250also can use with -p
Need to use with --host or -f
Sample:
python AlliN.py --host "10.0.0.1-10.0.0.2" -u '/login/index.jsp' -p 80
# It will send the requests as
10.0.0.1/login/index.jsp
10.0.0.2/login/index.jsp
Including a custom header
Sample:
python AlliN.py -f domain.txt -H "Cookie: xxxxx; UxxxxxxxN=Sxxxxp"
-u from the file
Sample:
python AlliN.py --host "10.0.0.1-10.0.0.2" --uf urlpath.list -p 80
urlpathlist:
index.php
index.jsp
# It will send the requests as
10.0.0.1/index.php => 10.0.0.1/index.jsp =>10.0.0.2/index.php => 10.0.0.2/index.jspNumber of threads, default is 200
Sample:
-t 200
Name of the report file
Sample:
-o answer.txt
Name of the report json file
Sample:
--oJ answer.json
Scanning without cert identification.
Sample:
python AlliN.py --host 192.168.1.1/24 -p 443 --nocert
Report with cert identification
[ https://1.1.1.1 | Server:Microsoft-HTTPAPI/2.0 | 400 | Size:334 | Bad Request | Certs URL: uat1.sandbox.operations.dynamics.cn | DigiCert Inc ]Close the processing bar
python AlliN.py --host 192.168.1.1/24 --nobar
Only displays the status codes which are allowed.
Sample:
--only-show 200,301
--hidden
Filter specifies status code.
Sample:
--hidden 404,400
--hiddensize
Filter the length of response
Sample:
--hiddensize 27,5367 # Filter the responses which length is 26 and 5367
Header scan model
python AlliN.py --host 192.168.1.1/24 -p 443 --ddAdd an extra url scan of favicon.ico
python AlliN.py --host 192.168.1.1/24 --tpSize of each result number by fofa scan, default is 10,000
Method of scan, default is tscan
Obtain the address of the remote host network card
python AlliN.py -m oxid --host 192.168.129.130
Port is 135
[*] 127.0.0.1
[->]hecs-xxxx0622130100
[->]192.168.0.57
[->]2001xxxxf57:ffc6
{'127.0.0.1': ['hxx-x-medixx-2-win-2020xxxx', '192.168.0.57', '2001xxxx3f57:ffc6']}Scan the backup of a site
python AlliN.py --host 192.168.1.1/24 -p 443 -m bakscan
python AlliN.py --host 192.168.1.1/24 -p 443 -m bakscan -f dic.txt
or use with the header model
python AlliN.py --host 192.168.1.1/24 -p 443 -m bakscan --dd
Combine with subscan and fofascan
python AlliN.py -q 'domain="xx.com"' --host xxx.com -m sfscan
Use for several domains
python AlliN.py -q 'domain="xx.com"' --host xxx.com,yyy.com -m sfscan
Brute the key of shiro, only support CBC encryption currently
python AlliN.py --host example.com -m shscan
Fuzz subdomain, it will replace the [fuzz] to host
Sample:
python AlliN.py --host "www.[fuzz]baidu.top" -f test.txt -m ddscan
python AlliN.py --host "[fuzz].baidu.top" -f test.txt -m ddscan
python AlliN.py --host "[fuzz].baidu.top" -f test.txt -m ddscan --ddFuzz the host of a request body
GET /xxx.html HTTP/1.1
Host: [fuzz].example.com
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36
Connection: close
Sample:
python AlliN.py -m hostscan --host https://1.1.1.1 --domain example.com -f dic.txt --nocert
Similary with hostscan, change the IP with a correct host
Sample:
python AlliN.py -m vhostscan -f dict.txt --domain example.com --nocert
Fofa scan, reference https://fofa.info/api
-q
--fs # default is 10,000
Sample:
python AlliN.py -q domain="baidu.com" -m fscan --fs 200
Port scan
Use the -p- to include all of the ports
Sample:
python AlliN.py --host 10.1.1.1/24 -p 80 -m pscan
Title scan, the default scan method
Sample:
python AlliN.py --host 10.1.1.1/24 -p 80
MS17-010 vulnerable scan
Sample:
python AlliN.py --host 10.1.1.1/24 -m 17scan
DOUBLEPULSAR backdoor check
Sample:
python AlliN.py --host 10.1.1.1/24 -m dpscan --verbose
nbtscan
Sample:
python AlliN.py --host 10.1.1.1/24 -m nbscan
Subdomain scan
Sample:
python AlliN.py --host "xx.com" -m subscan
tscan without header of rememberMe=xxx
Sample:
python AlliN.py --host 10.1.1.1/24 -p 80 -m sscan
t3scan is a module of WebLogic information collection, it is based on the protocol of t3 and iiop
Sample:
python AlliN.py --host 10.1.1.1/24 -p 7001 -m t3scan
Notice: Port is necessary
Decode model
Include powershell encode 、bash encode 、 F5 decode
Sample:
python AlliN.py -m uncd -e f5 -s 185903296.21520.0000
-e f5 f5decode
-e pw powershell encode
-e bh bash encode
CVE-2019-0708 vulnerable scan
Sample:
python AlliN.py --host 192.168.1.1/24 -m 0708scan -p 3389
NAT traversal
Nedd privileged of icmp Ping
There two steps to start it - server and client
first step: type python AlliN.py -m icmpt on your own VPS
next step: In client, type python AlliN.py -m icmpt --sip vps --cip 127.0.0.1 --cport 80
It will have the following content after you finish the second step
Accpet new client from : 14178 192.168.148.1
Your server port is :33127
And the 33127 port of your VPS is the correct 80 port of the client
Sample:
python AlliN.py -m icmpt --sip vps --cip 127.0.0.1 --cport 80
Then you can browse vps_ip:36267 to access target_ip:target_port
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent