ALLiN

English | 简体中文

A comprehensive tool that assists penetration testing projects. It is a flexible, compact and efficient scan tool mainly used for lateral penetration of the intranet. The format of targets can be written by most of the various forms of link or CIDR and add any ports and paths to it.

Core developers

@Like0x

@Christasa

@CoColi

@MiluOWO

Penetration test only

Features

• python2.7 - python3.x support without and depend
• Passively identify some frameworks, components of the site and over 1000 data of fingerprints
• Passively identify whether the site is on the cloud
• Almost support for import with the arbitrary format

Some tricks

• Using across platforms after compiling by pyinstaller
  • Compiling with low-level GLIBC in Linux to be compatible with more kernel versions
  • Compiling with python2 on windows to reduce the error of lacking DLL
• Use it in VPS for resolving network problems
• Eliminate the account information when scanning on the intranet

Control the file through --project

• res_alivedomain.txt will save all the report automatically
• folder tree
  • result.txt
  • focuson.txt

Use the following script to scan if you have many tasks

target.txt

<name of a company> xxx.com
<name of another company> xxx.io

#!/bin/bash

while read line
do
    project=`echo $line | awk -F " " '{print $1}'`
    host=`echo $line | awk -F " " '{print $2}'`
    echo $host,$project
    python AlliN.py --host $host -q "(domain=\"$host\" || cert=\"$host\"  || title=\"$project\") &&  country=\"CN\" && region!=\"HK\" && region!=\"TW\" && region!=\"MO\"" -m sfscan --timeout 6 --project $project -t 100
done < target.txt

Parameters

--host

Designate the domains or hosts

Samples:

--host 10.1.1.1
--host 10.1.1.1-10.2.2.2
--host 10.1.1.1/24 # any CIDR
--host 10.1.1.1-255
--host 2001:db8::/126 # any CIDR
--host [2001:4860:4860::8888]
--host 2001:db8::1-2001:db8::5
--host <arbitrary format of the domain>

--timeout

Default is 3

--timeout 3

--ctimeout

Timeout of pscan, default is 0.5

--ctimeout 0.5

--proxy

--proxy http://127.0.0.1:8081
--proxy http://user:pass@127.0.0.1:8801
--proxy socks5://127.0.0.1:1080
--proxy socks5://user:pass@127.0.0.1:1080

pip install PySocks before using it

--project

Name of scan project, it will create a folder for saving results

-p

Designate the ports

Samples:

-p 80
-p 80,443
-p 8000-9000
-p 80,8000-9000
-p-  all of ports

-f

Name of the input file

Samples:

-f iplist.txt

There are many formats of targets, such as

http://www.baidu.com

1.1.1.1/24

www.baidu.com/asd

www.baidu.com:80/123

1.1.1.1/sads

1.1.1.1:8080/123

1.1.1.1-250

1.1.1.1-1.1.1.250

also can use with -p

-u

Need to use with --host or -f

Sample:

python AlliN.py --host "10.0.0.1-10.0.0.2" -u '/login/index.jsp' -p 80

# It will send the requests as
10.0.0.1/login/index.jsp
10.0.0.2/login/index.jsp

-H

Including a custom header

Sample:

python AlliN.py -f domain.txt -H "Cookie: xxxxx; UxxxxxxxN=Sxxxxp"

--uf

-u from the file

Sample:

python AlliN.py --host "10.0.0.1-10.0.0.2" --uf urlpath.list -p 80

urlpathlist:
index.php
index.jsp


# It will send the requests as
10.0.0.1/index.php => 10.0.0.1/index.jsp =>10.0.0.2/index.php => 10.0.0.2/index.jsp

-t

Number of threads, default is 200

Sample:

-t 200

-o

Name of the report file

Sample:

-o answer.txt

--oJ

Name of the report json file

Sample:

--oJ answer.json

--nocert

Scanning without cert identification.

Sample:

python AlliN.py --host 192.168.1.1/24 -p 443 --nocert

Report with cert identification

[  https://1.1.1.1  | Server:Microsoft-HTTPAPI/2.0 |  400  | Size:334 |  Bad Request  | Certs URL: uat1.sandbox.operations.dynamics.cn | DigiCert Inc  ]

--nobar

Close the processing bar

python AlliN.py --host 192.168.1.1/24 --nobar

--only-show

Only displays the status codes which are allowed.

Sample:

--only-show 200,301

--hidden

Filter specifies status code.

Sample:

--hidden 404,400

--hiddensize

Filter the length of response

Sample:

--hiddensize 27,5367 # Filter the responses which length is 26 and 5367

--dd

Header scan model

python AlliN.py --host 192.168.1.1/24 -p 443 --dd

--tp

Add an extra url scan of favicon.ico

python AlliN.py --host 192.168.1.1/24 --tp

--fs

Size of each result number by fofa scan, default is 10,000

-m

Method of scan, default is tscan

oxid

Obtain the address of the remote host network card

python AlliN.py -m oxid --host 192.168.129.130

Port is 135

[*] 127.0.0.1
        [->]hecs-xxxx0622130100
        [->]192.168.0.57
        [->]2001xxxxf57:ffc6
{'127.0.0.1': ['hxx-x-medixx-2-win-2020xxxx', '192.168.0.57', '2001xxxx3f57:ffc6']}

bakscan

Scan the backup of a site

python AlliN.py --host 192.168.1.1/24 -p 443 -m bakscan

python AlliN.py --host 192.168.1.1/24 -p 443 -m bakscan -f dic.txt

or use with the header model

python AlliN.py --host 192.168.1.1/24 -p 443 -m bakscan --dd

sfscan

Combine with subscan and fofascan

python AlliN.py -q 'domain="xx.com"' --host xxx.com -m sfscan

Use for several domains

python AlliN.py -q 'domain="xx.com"' --host xxx.com,yyy.com -m sfscan

shscan

Brute the key of shiro, only support CBC encryption currently

python AlliN.py --host example.com -m shscan

ddscan

Fuzz subdomain, it will replace the [fuzz] to host

Sample:

python AlliN.py --host "www.[fuzz]baidu.top" -f test.txt  -m ddscan
python AlliN.py --host "[fuzz].baidu.top" -f test.txt  -m ddscan
python AlliN.py --host "[fuzz].baidu.top" -f test.txt  -m ddscan --dd

hostscan

Fuzz the host of a request body

GET /xxx.html HTTP/1.1
Host: [fuzz].example.com
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36
Connection: close

Sample:

python AlliN.py -m hostscan --host https://1.1.1.1 --domain example.com -f dic.txt --nocert

vhostscan

Similary with hostscan, change the IP with a correct host

Sample:

python AlliN.py -m vhostscan -f dict.txt --domain example.com --nocert

fscan

Fofa scan, reference https://fofa.info/api

-q
--fs # default is 10,000

Sample:

python AlliN.py -q domain="baidu.com" -m fscan --fs 200

pscan

Port scan

Use the -p- to include all of the ports

Sample:

python AlliN.py --host 10.1.1.1/24 -p 80 -m pscan

tscan

Title scan, the default scan method

Sample:

python AlliN.py --host 10.1.1.1/24 -p 80

17scan

MS17-010 vulnerable scan

Sample:

python AlliN.py --host 10.1.1.1/24 -m 17scan

dpscan

DOUBLEPULSAR backdoor check

Sample:

python AlliN.py --host 10.1.1.1/24 -m dpscan --verbose

nbscan

nbtscan

Sample:

python AlliN.py --host 10.1.1.1/24 -m nbscan

subscan

Subdomain scan

Sample:

python AlliN.py --host "xx.com" -m subscan

sscan

tscan without header of rememberMe=xxx

Sample:

python AlliN.py --host 10.1.1.1/24 -p 80 -m sscan

t3scan

t3scan is a module of WebLogic information collection, it is based on the protocol of t3 and iiop

Sample: python AlliN.py --host 10.1.1.1/24 -p 7001 -m t3scan

Notice: Port is necessary

uncd

Decode model

Include powershell encode 、bash encode 、 F5 decode

Sample:

python AlliN.py -m uncd -e f5 -s 185903296.21520.0000

-e f5 f5decode
-e pw powershell encode
-e bh bash encode

0708scan

CVE-2019-0708 vulnerable scan

Sample:

python AlliN.py --host 192.168.1.1/24 -m 0708scan -p 3389

ICMPT

NAT traversal

Nedd privileged of icmp Ping

There two steps to start it - server and client

first step: type python AlliN.py -m icmpt on your own VPS

next step: In client, type python AlliN.py -m icmpt --sip vps --cip 127.0.0.1 --cport 80

It will have the following content after you finish the second step

Accpet new client from : 14178 192.168.148.1
Your server port is :33127

And the 33127 port of your VPS is the correct 80 port of the client

Sample:

python AlliN.py -m icmpt --sip vps --cip 127.0.0.1 --cport 80

Then you can browse vps_ip:36267 to access target_ip:target_port