______ __ ______ __ __ __ __ _____ __ __ __ | __ \.-----.--| |______| __ \.---.-.| |--.| |--.|__| |_ ______| \.-----.----.--.--.--------.-----.-----.| |_.---.-.| |_|__|.-----.-----. | <| -__| _ |______| <| _ || _ || _ || | _|______| -- | _ | __| | | | -__| || _| _ || _| || _ | | |___|__||_____|_____| |___|__||___._||_____||_____||__|____| |_____/|_____|____|_____|__|__|__|_____|__|__||____|___._||____|__||_____|__|__| The next few sections will be dedicated to the red rabbit documentation, the sections will be disected by module, eg: (0x0001 is module search) it goes from there from the list above. Another example of how modules will be seperated is by the cloumn number in the chart above where Brute is the second module name, its section will be labeled 0x0002 - BRUTE -, please take your time going through the documentation ALOT of people often forget about documentation then come to the devs confused as to why some dont work, or how the script works and how to use it, so please, when i mean read it i mean READ IT CAREFULLY!






0x103 - Extra utilities
This section explains every thing that was not a major module, eg atk, or certian newer commands

A breif intro as to how the red rabbit terminal works

I did not want to go over this or bother making this a section in other command like sections so why not do it here. Red rabbit works alot like metasploit in terms of running options, it has a module, each module has its own utility, say the module search right. The search module stays static but its subroutines dont `search mx` changes at mx `search head` changes at head. Take the following tree as an example of how modules work
| - engine |> engine ogoogle |> engine otwitter |> engine ofacebook |> engine olinkedin |> engine cve |> engine tcve |> engine shodanh
so do note, all options that you input whatever the first thing you type to run that module is going to be the module name, a way to shorten the giant ass command list is to type `help module_name` example as `help inject` will output all information and commands under the module inject in a organized and fit manner

> Section API, this section will talk about all API commands

- api layerus config

as I have mentioned here before every command ending in config, conf, setting, or custom is a customized command, where data is read from a file, a yaml file, a json file, or some other file. the API layerus config command uses a file in the directory `API/configuration` named api_keys.json, this json file is structured like the following
{ "API_Keys": { "WHOIS_KEY": "Your www.whoisxmlapi.com API key here", "WHOIS_USR": "your whois_username here", "WHOIS_PAS": "your whois_password here", "APILA_KEY": "your api layer key here" } }
for the api layerus config command you will need to input your API layer API key in the APILA_KEY section of the json file. once done then you can run the command this command traces and gets all information on a US phone number, this is not just API layer being used but also red rabbits custom offline databases for matches take the following example as a number19644520897
[!] Example: Format must be as follows +xxxxxxxxxxx EX -> +19644520897 Enter a number > +19644520897 [!] Example: format must be xxx example is as follows -> 334 Enter the dial code > 964 |-| Using -> http://apilayer.net/api/validate?access_key=lG3PGw5SnGQHchzcfaLEDmZOMBwdMr3Z&number=+19644520897&country_code=&format=1 Cache-Control [no-cache] Content-Type [application/json; Charset=UTF-8] Access-Control-Allow-Methods [GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS] Access-Control-Allow-Origin [*] X-Blocked-At-Loadbalancer [1] |+| Phone information -> Valid : false |+| Phone information -> Number : 644-520-897 |+| Phone information -> Local Format : 664 |+| Phone information -> World Format : +19644520897 |+| Phone information -> Country Code : US |+| Phone information -> Country Prefix : USA |+| Phone information -> Location : Some random city |+| Phone information -> Carrier : some random carrier |+| Phone information -> Line type : LAN |+| Phone Information -> Country code to prefix : some country code |+| Phone Information -> Country code to name : some country name |+| Phone Information -> Country code to currency : some country currency |+| Phone Information -> Country ISO2 to ISO3 : some ISO3 |+| Phone Information -> Country ISO3 to capital : some capital

- api layerbe config

this is the same as above but just uses red rabbits belgium database for finding extra information such as country codes, country name, city name etc

- api layerus

this is the same thing as the api layerus config but you manually input your API key

- api layerbe

same command as api layerbe config but the key is manually inputted by the user

- api whoisx config

whois xml is a pretty big whois api, and with red rabbits intensly generated types and responses it is able to get a good amount of information from it using the api, this command works as any other config command above, the api key will be stored in the file `api_keys.json` in the filepath `API/configuration`, your api key will be put in the JSON field labled `WHOIS_KEY` however you will also need your username and password which go in the fields `WHOIS_PAS` and `WHOIS_USR` where `WHOIS_USR` is your whoisxml username and `WHOIS_PAS` is the field for your whoisxml password. when thats all set run the command and you input a website or domain name you will get the following output
---------------[ Contact and Administration ] --------------------- [+] Contact Email : -> abusecomplaints@markmonitor.com [+] Organization : -> Google LLC [+] Country Name : -> UNITED STATES [+] Country Code : -> US [+] State : -> CA [+] Contact Country : -> UNITED STATES [+] Contact Organiz : -> Google LLC [+] Contact State : -> CA ---------------[ Dates, Times, and Registration ] --------------------- [+] Created Date : -> 1997-09-15T07:00:00+0000 [+] Created Date normal : -> 1997-09-15 07:00:00 UTC [+] Audit Created Date : -> 2022-06-27 11:01:45 UTC [+] Audit Updated Date : -> 2022-06-27 11:01:45 UTC [+] Expires Date : -> 2028-09-13T07:00:00+0000 [+] Expires Date normal : -> 2028-09-13 07:00:00 UTC [+] Updated Date : -> 2019-09-09T15:39:04+0000 [+] Registry Date Create : -> 1997-09-15 04:00:00 UTC [+] Registry Date Create : -> 9051 ---------------[ Whois Record | Registry Information ] --------------------- [+] Registry Date Create : -> google.com [+] Registry Date Create : -> google.com [+] Domain NS Hostnames -> [+] Registry Data Status : -> clientDeleteProhibited clientTransferProhibited clientUpdateProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited [+] Registry Date Create : -> 251 [+] Registry Data Header : -> [+] Registry Data Footer : -> [+] Registry Data audit create : -> 2022-06-27 11:01:44 UTC [+] Registry Data audit update : -> 2022-06-27 11:01:44 UTC [+] Registry Data registrar Name : -> MarkMonitor Inc. [+] Registry Data registrar IANAID : -> 292 [+] Registry Data registrar Create : -> 1997-09-15 04:00:00 UTC [+] Registry Data registrar Update : -> 2019-09-09 15:39:04 UTC [+] Registry Data Expires Date : -> 2028-09-14 04:00:00 UTC [+] Registry Data WHOIS server : -> whois.markmonitor.com

- api whoisxml

same thing as above but without the api key being in a config file, rather just manually inputting the key yourself each time

- api grab config

this config will simply locate and pull all API keys from all configuration files used for api's or other settings in red rabbit.

Engine

> This section will talk about all commands in the engine module. The engnine module utilizes google to scrape for certian information from a given search query. the engine module can be set with flags such as using the --SQ option to set a search query, the --RPP option to set the reuslts per page, and the --PTC to name the amount of pages to crawl of google for your information. an example using the flags would be sudo go run main.go --SQ="inurl:index.php?id=1" --RPP=10 --PTC=1 example usage of the enguine would be if you search for user1234 as a search query you will get the following output.
[TAG] > people -> |+| -> https://twitter.com/user1234 [TAG] > people -> |+| -> https://twitter.com/user1234 [TAG] > people -> |+| -> https://twitter.com/usern0u [TAG] > people -> |+| -> https://twitter.com/user1234 [TAG] > people -> |+| -> https://twitter.com/usern0u [TAG] > people -> |+| -> https://mobile.twitter.com/gabsvel [TAG] > people -> |+| -> https://twitter.com/user1234 [TAG] > people -> |+| -> https://twitter.com/usern0u [TAG] > people -> |+| -> https://mobile.twitter.com/gabsvel [TAG] > people -> |+| -> https://mobile.twitter.com/usembswaziland [TAG] > people -> |+| -> https://twitter.com/user1234 [TAG] > people -> |+| -> https://twitter.com/usern0u [TAG] > people -> |+| -> https://mobile.twitter.com/gabsvel [TAG] > people -> |+| -> https://mobile.twitter.com/usembswaziland [TAG] > people -> |+| -> https://mobile.twitter.com/kun_trev [TAG] > people -> |+| -> https://twitter.com/user1234 [TAG] > people -> |+| -> https://twitter.com/usern0u [TAG] > people -> |+| -> https://mobile.twitter.com/gabsvel [TAG] > people -> |+| -> https://mobile.twitter.com/usembswaziland [TAG] > people -> |+| -> https://mobile.twitter.com/kun_trev

- engine ogoogle

this command will search for just google related results. if it has any other information or link that is not google related then it will skip it and not append it. Sometimes it will grab information from other sources but its a small amount mainly the engine will generalize all targets around a google link. say you search for a website like the following inurl:"index.php?id=1" you will get something like the following output
[TAG] > RAW - -> |+| -> https://marine.rutgers.edu/po/index.php%3Fid%3D1 [TAG] > RAW - -> |+| -> https://support.google.com/webmasters/answer/7489871%3Fhl%3Den [TAG] > RAW - -> |+| -> https://login-db.onl/index-php-id-1-login-30589 [TAG] > RAW - -> |+| -> http://www.cacert.org/index.php%3Fid%3D1 [TAG] > RAW - -> |+| -> https://www.basisforliveart.com/index.php%3Fid%3D1 [TAG] > RAW - -> |+| -> http://www.harkavagrant.com/index.php%3Fid%3D1 [TAG] > RAW - -> |+| -> https://support.helpspot.com/index.php%3Fpg%3Dkb.page%26id%3D282 [TAG] > RAW - -> |+| -> http://helischrotter.de/24/inurl-index.php-id%3D1 [TAG] > RAW - -> |+| -> https://support.google.com/websearch%3Fp%3Dws_settings_location%26hl%3Den [TAG] > RAW - -> |+| -> http://www.vizzed.com/play/inurl%2520index.php%2520id%3D1 [TAG] > RAW - -> |+| -> http://www.dynamicdrive.com/forums/showthread.php%3F45397-In-a-website-that-ALL-webpages-are-of-index-php-id-1-index-php-id-2-index-php-id-3 [TAG] > RAW - -> |+| -> https://stackoverflow.com/questions/53474045/difference-between-index-phpid-1-and-index-php-id-1

- engine otwitter

This command does the same thing as the other one but will specify links ONLY to twitter links or links found from the third or second position away from a twitter searched query, so if you search for something like a username you will get mostly twitter links with just that username or people who have a account tied to that username

- engine ofacebook

This command does the same thing as the one above but will specify links ONLY to facebook links or links found from the third or second position away from a facebook searched query, so if you search for something like a username you will get mostly facebook links with just that username or people who have a account tied to that username

- engine olinkedin

This command does the same thing as the one above but will specify links ONLY to linkedin links or links found from the third or second position away from a linkedin searched query, so if you search for something like a username you will get mostly linkedin links with just that username or people who have a account tied to that username

- engine shodanh

This command will search shodan using a API key to search for information on a host, say you have a host of 1.1.1.1 to search you would use this engine option to show information on that hostname or of all results that engine pulled in search for that query or hostname.

- engine cve

This command also uses the google engine but instead of searching google for information it will search a CVE database for information, such as a CVE's name, date, moded date, Description, information, articles, or other relevant data to teach you about certian CVE's. You can search by date or name of the CVE and example is `shop`
|+| CVE Name > {CVE MITRE 4.0 {CVE-2022-31101 security-advisories@github.com} {[{[{en CWE-89}]}]} {[{https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp CONFIRM []} {https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 MISC []}]} {[{en prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.}]}} |+| Last Modded > 2022-06-27T23:15Z |+| Published > 2022-06-27T23:15Z |+| Data type > CVE |+| Data format > MITRE |+| Description > {[{en prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.}]} |+| CVE impact > {{{ 0 } 0 0} {{ 0} 0 0 false false false false false}} ============================================================================================================= ============================================================================================================= |+| CVE Name > {CVE MITRE 4.0 {CVE-2022-31057 security-advisories@github.com} {[{[{en CWE-79}]}]} {[{https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022 https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022 MISC []} {https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj CONFIRM []} {https://packagist.org/packages/shopware/shopware https://packagist.org/packages/shopware/shopware MISC []} {https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f MISC []}]} {[{en Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.}]}} |+| Last Modded > 2022-06-27T20:15Z |+| Published > 2022-06-27T20:15Z |+| Data type > CVE |+| Data format > MITRE |+| Description > {[{en Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.}]} |+| CVE impact > {{{ 0 } 0 0} {{ 0} 0 0 false false false false false}}
there is another option and that is simple to use tor to reach the database thats holds the CVE information, this option is `engine tcve` simply just using a proxy to reach and pull data from the database.

Stalk

This is the section which will talk about two options in the stalk module

- stalk hosts and stalk hosts2

both are relative to each other, the only difference is the brute forcing method, so stalk hosts is a subset which will allow the user to set 3 or 2 octets or a network address. stalk hosts will allow the user to input 3 octets and example is (172.217.2) and you will brute force all possible ranges and network addresses that match anf youll get something like the following using that example
|+| 172.217.2.136 yyz08s14-in-f136.1e100.net.,mia09s18-in-f8.1e100.net.,qro04s02-in-f8.1e100.net. |+| 172.217.2.124 iad23s72-in-f28.1e100.net.,yyz10s05-in-f28.1e100.net. |+| 172.217.2.209 mia09s02-in-f17.1e100.net.,iad23s23-in-f209.1e100.net. |+| 172.217.2.205 iad23s23-in-f205.1e100.net.,mia09s02-in-f13.1e100.net. |+| 172.217.2.206 iad23s23-in-f206.1e100.net.,mia09s02-in-f14.1e100.net. |+| 172.217.2.208 mia09s02-in-f16.1e100.net.,iad23s23-in-f208.1e100.net. |+| 172.217.2.140 mia09s18-in-f12.1e100.net.,qro04s02-in-f12.1e100.net.,yyz08s14-in-f140.1e100.net.
the second one stalk hosts2 again does the same but you can instead of input (172.217.2) you can do (172.217) and it will brute force all possible combinations until it finds a server like the following output
|+| 172.217.3.58 iad23s57-in-f26.1e100.net. |+| 172.217.3.239 lax32s01-in-f15.1e100.net. |+| 172.217.3.239 atl14s79-in-f15.1e100.net. |+| 172.217.1.180 iad39s04-in-f20.1e100.net. |+| 172.217.1.180 yyz10s04-in-f20.1e100.net. |+| 172.217.2.6 lga15s45-in-f6.1e100.net.

Proxy downloading

> fetch proxy4, fetch proxy5 both of these commands do the same thing. what they do is download proxies and save them to a output file you specified wether it was from using the -o flag or by manually typing it when the program asks for it. however the difference is proxy4 will fetch all proxies it can for SOCKS4, proxy5 will fetch all proxies for SOCKS5 > fetch http/https/httpssl/httpsssl like the one above all of these are similar, specify an output file and it will download and save proxies to that given file. fetch http/https commands will fetch all proxies relating to a http/https like address, there are options to also use SSL for the proxy grabbing list. fetch htpssl and httpsssl will grab proxies of either http or https and make sure they are specified to just SSL, anything without SSL will not be added to the list.