______ __ ______ __ __ __ __ _____ __ __ __
| __ \.-----.--| |______| __ \.---.-.| |--.| |--.|__| |_ ______| \.-----.----.--.--.--------.-----.-----.| |_.---.-.| |_|__|.-----.-----.
| <| -__| _ |______| <| _ || _ || _ || | _|______| -- | _ | __| | | | -__| || _| _ || _| || _ | |
|___|__||_____|_____| |___|__||___._||_____||_____||__|____| |_____/|_____|____|_____|__|__|__|_____|__|__||____|___._||____|__||_____|__|__|
The next few sections will be dedicated to the red rabbit documentation, the sections will be disected by module, eg: (0x0001 is module search) it goes from there
from the list above. Another example of how modules will be seperated is by the cloumn number in the chart above where Brute is the second module name, its section will
be labeled 0x0002 - BRUTE -, please take your time going through the documentation ALOT of people often forget about documentation then come to the devs confused as to
why some dont work, or how the script works and how to use it, so please, when i mean read it i mean READ IT CAREFULLY!
This section explains every thing that was not a major module, eg atk, or certian newer commands
A breif intro as to how the red rabbit terminal works
I did not want to go over this or bother making this a section in other
command like sections so why not do it here. Red rabbit works alot like
metasploit in terms of running options, it has a module, each module has its
own utility, say the module search right. The search module stays static but its
subroutines dont `search mx` changes at mx `search head` changes at head. Take the
following tree as an example of how modules work
| - engine
|> engine ogoogle
|> engine otwitter
|> engine ofacebook
|> engine olinkedin
|> engine cve
|> engine tcve
|> engine shodanh
so do note, all options that you input whatever the first thing you type
to run that module is going to be the module name, a way to shorten the giant
ass command list is to type `help module_name` example as `help inject` will output
all information and commands under the module inject in a organized and fit manner
> Section API, this section will talk about all API commands
- api layerus config
as I have mentioned here before every command ending in config, conf, setting, or custom
is a customized command, where data is read from a file, a yaml file, a json file, or some
other file. the API layerus config command uses a file in the directory `API/configuration`
named api_keys.json, this json file is structured like the following
{
"API_Keys": {
"WHOIS_KEY": "Your www.whoisxmlapi.com API key here",
"WHOIS_USR": "your whois_username here",
"WHOIS_PAS": "your whois_password here",
"APILA_KEY": "your api layer key here"
}
}
for the api layerus config command you will need to input your API layer API key in the
APILA_KEY section of the json file. once done then you can run the command
this command traces and gets all information on a US phone number, this is not just API layer
being used but also red rabbits custom offline databases for matches take the following example
as a number19644520897
[!] Example: Format must be as follows +xxxxxxxxxxx EX -> +19644520897
Enter a number > +19644520897
[!] Example: format must be xxx example is as follows -> 334
Enter the dial code > 964
|-| Using -> http://apilayer.net/api/validate?access_key=lG3PGw5SnGQHchzcfaLEDmZOMBwdMr3Z&number=+19644520897&country_code=&format=1
Cache-Control [no-cache]
Content-Type [application/json; Charset=UTF-8]
Access-Control-Allow-Methods [GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS]
Access-Control-Allow-Origin [*]
X-Blocked-At-Loadbalancer [1]
|+| Phone information -> Valid : false
|+| Phone information -> Number : 644-520-897
|+| Phone information -> Local Format : 664
|+| Phone information -> World Format : +19644520897
|+| Phone information -> Country Code : US
|+| Phone information -> Country Prefix : USA
|+| Phone information -> Location : Some random city
|+| Phone information -> Carrier : some random carrier
|+| Phone information -> Line type : LAN
|+| Phone Information -> Country code to prefix : some country code
|+| Phone Information -> Country code to name : some country name
|+| Phone Information -> Country code to currency : some country currency
|+| Phone Information -> Country ISO2 to ISO3 : some ISO3
|+| Phone Information -> Country ISO3 to capital : some capital
- api layerbe config
this is the same as above but just uses red rabbits belgium database for finding
extra information such as country codes, country name, city name etc
- api layerus
this is the same thing as the api layerus config but you manually input
your API key
- api layerbe
same command as api layerbe config but the key is manually inputted by the user
- api whoisx config
whois xml is a pretty big whois api, and with red rabbits intensly generated types
and responses it is able to get a good amount of information from it using the api,
this command works as any other config command above, the api key will be stored in
the file `api_keys.json` in the filepath `API/configuration`, your api key will be put in
the JSON field labled `WHOIS_KEY` however you will also need your username and password
which go in the fields `WHOIS_PAS` and `WHOIS_USR` where `WHOIS_USR` is your whoisxml username
and `WHOIS_PAS` is the field for your whoisxml password.
when thats all set run the command and you input a website or domain name you will get the following
output
---------------[ Contact and Administration ] ---------------------
[+] Contact Email : -> abusecomplaints@markmonitor.com
[+] Organization : -> Google LLC
[+] Country Name : -> UNITED STATES
[+] Country Code : -> US
[+] State : -> CA
[+] Contact Country : -> UNITED STATES
[+] Contact Organiz : -> Google LLC
[+] Contact State : -> CA
---------------[ Dates, Times, and Registration ] ---------------------
[+] Created Date : -> 1997-09-15T07:00:00+0000
[+] Created Date normal : -> 1997-09-15 07:00:00 UTC
[+] Audit Created Date : -> 2022-06-27 11:01:45 UTC
[+] Audit Updated Date : -> 2022-06-27 11:01:45 UTC
[+] Expires Date : -> 2028-09-13T07:00:00+0000
[+] Expires Date normal : -> 2028-09-13 07:00:00 UTC
[+] Updated Date : -> 2019-09-09T15:39:04+0000
[+] Registry Date Create : -> 1997-09-15 04:00:00 UTC
[+] Registry Date Create : -> 9051
---------------[ Whois Record | Registry Information ] ---------------------
[+] Registry Date Create : -> google.com
[+] Registry Date Create : -> google.com
[+] Domain NS Hostnames ->
[+] Registry Data Status : -> clientDeleteProhibited clientTransferProhibited clientUpdateProhibited serverDeleteProhibited serverTransferProhibited serverUpdateProhibited
[+] Registry Date Create : -> 251
[+] Registry Data Header : ->
[+] Registry Data Footer : ->
[+] Registry Data audit create : -> 2022-06-27 11:01:44 UTC
[+] Registry Data audit update : -> 2022-06-27 11:01:44 UTC
[+] Registry Data registrar Name : -> MarkMonitor Inc.
[+] Registry Data registrar IANAID : -> 292
[+] Registry Data registrar Create : -> 1997-09-15 04:00:00 UTC
[+] Registry Data registrar Update : -> 2019-09-09 15:39:04 UTC
[+] Registry Data Expires Date : -> 2028-09-14 04:00:00 UTC
[+] Registry Data WHOIS server : -> whois.markmonitor.com
- api whoisxml
same thing as above but without the api key being in a config file, rather just
manually inputting the key yourself each time
- api grab config
this config will simply locate and pull all API keys from all configuration files
used for api's or other settings in red rabbit.
Engine
> This section will talk about all commands in the engine module.
The engnine module utilizes google to scrape for certian information
from a given search query. the engine module can be set with flags such
as using the --SQ option to set a search query, the --RPP option to set
the reuslts per page, and the --PTC to name the amount of pages to crawl
of google for your information. an example using the flags would be
sudo go run main.go --SQ="inurl:index.php?id=1" --RPP=10 --PTC=1
example usage of the enguine would be if you search for user1234 as a
search query you will get the following output.
[TAG] > people -> |+| -> https://twitter.com/user1234
[TAG] > people -> |+| -> https://twitter.com/user1234
[TAG] > people -> |+| -> https://twitter.com/usern0u
[TAG] > people -> |+| -> https://twitter.com/user1234
[TAG] > people -> |+| -> https://twitter.com/usern0u
[TAG] > people -> |+| -> https://mobile.twitter.com/gabsvel
[TAG] > people -> |+| -> https://twitter.com/user1234
[TAG] > people -> |+| -> https://twitter.com/usern0u
[TAG] > people -> |+| -> https://mobile.twitter.com/gabsvel
[TAG] > people -> |+| -> https://mobile.twitter.com/usembswaziland
[TAG] > people -> |+| -> https://twitter.com/user1234
[TAG] > people -> |+| -> https://twitter.com/usern0u
[TAG] > people -> |+| -> https://mobile.twitter.com/gabsvel
[TAG] > people -> |+| -> https://mobile.twitter.com/usembswaziland
[TAG] > people -> |+| -> https://mobile.twitter.com/kun_trev
[TAG] > people -> |+| -> https://twitter.com/user1234
[TAG] > people -> |+| -> https://twitter.com/usern0u
[TAG] > people -> |+| -> https://mobile.twitter.com/gabsvel
[TAG] > people -> |+| -> https://mobile.twitter.com/usembswaziland
[TAG] > people -> |+| -> https://mobile.twitter.com/kun_trev
- engine ogoogle
this command will search for just google related results.
if it has any other information or link that is not google
related then it will skip it and not append it. Sometimes it will
grab information from other sources but its a small amount mainly
the engine will generalize all targets around a google link.
say you search for a website like the following inurl:"index.php?id=1"
you will get something like the following output
[TAG] > RAW - -> |+| -> https://marine.rutgers.edu/po/index.php%3Fid%3D1
[TAG] > RAW - -> |+| -> https://support.google.com/webmasters/answer/7489871%3Fhl%3Den
[TAG] > RAW - -> |+| -> https://login-db.onl/index-php-id-1-login-30589
[TAG] > RAW - -> |+| -> http://www.cacert.org/index.php%3Fid%3D1
[TAG] > RAW - -> |+| -> https://www.basisforliveart.com/index.php%3Fid%3D1
[TAG] > RAW - -> |+| -> http://www.harkavagrant.com/index.php%3Fid%3D1
[TAG] > RAW - -> |+| -> https://support.helpspot.com/index.php%3Fpg%3Dkb.page%26id%3D282
[TAG] > RAW - -> |+| -> http://helischrotter.de/24/inurl-index.php-id%3D1
[TAG] > RAW - -> |+| -> https://support.google.com/websearch%3Fp%3Dws_settings_location%26hl%3Den
[TAG] > RAW - -> |+| -> http://www.vizzed.com/play/inurl%2520index.php%2520id%3D1
[TAG] > RAW - -> |+| -> http://www.dynamicdrive.com/forums/showthread.php%3F45397-In-a-website-that-ALL-webpages-are-of-index-php-id-1-index-php-id-2-index-php-id-3
[TAG] > RAW - -> |+| -> https://stackoverflow.com/questions/53474045/difference-between-index-phpid-1-and-index-php-id-1
- engine otwitter
This command does the same thing as the other one
but will specify links ONLY to twitter links or links
found from the third or second position away from a
twitter searched query, so if you search for something
like a username you will get mostly twitter links with
just that username or people who have a account tied
to that username
- engine ofacebook
This command does the same thing as the one above
but will specify links ONLY to facebook links or links
found from the third or second position away from a
facebook searched query, so if you search for something
like a username you will get mostly facebook links with
just that username or people who have a account tied
to that username
- engine olinkedin
This command does the same thing as the one above
but will specify links ONLY to linkedin links or links
found from the third or second position away from a
linkedin searched query, so if you search for something
like a username you will get mostly linkedin links with
just that username or people who have a account tied
to that username
- engine shodanh
This command will search shodan using a API key
to search for information on a host, say you have
a host of 1.1.1.1 to search you would use this engine
option to show information on that hostname or of all
results that engine pulled in search for that query or
hostname.
- engine cve
This command also uses the google engine but instead
of searching google for information it will search a CVE
database for information, such as a CVE's name, date, moded date,
Description, information, articles, or other relevant data to teach
you about certian CVE's. You can search by date or name of the CVE
and example is `shop`
|+| CVE Name > {CVE MITRE 4.0 {CVE-2022-31101 security-advisories@github.com} {[{[{en CWE-89}]}]} {[{https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp https://github.com/PrestaShop/blockwishlist/security/advisories/GHSA-2jx3-5j9v-prpp CONFIRM []} {https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 https://github.com/PrestaShop/blockwishlist/commit/b3ec4b85af5fd73f74d55390b226d221298ca084 MISC []}]} {[{en prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.}]}}
|+| Last Modded > 2022-06-27T23:15Z
|+| Published > 2022-06-27T23:15Z
|+| Data type > CVE
|+| Data format > MITRE
|+| Description > {[{en prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.}]}
|+| CVE impact > {{{ 0 } 0 0} {{ 0} 0 0 false false false false false}}
=============================================================================================================
=============================================================================================================
|+| CVE Name > {CVE MITRE 4.0 {CVE-2022-31057 security-advisories@github.com} {[{[{en CWE-79}]}]} {[{https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022 https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2022 MISC []} {https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj https://github.com/shopware/shopware/security/advisories/GHSA-q754-vwc4-p6qj CONFIRM []} {https://packagist.org/packages/shopware/shopware https://packagist.org/packages/shopware/shopware MISC []} {https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f https://github.com/shopware/shopware/commit/3e025a0a3e123f4108082645b1ced6fb548f7b6f MISC []}]} {[{en Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.}]}}
|+| Last Modded > 2022-06-27T20:15Z
|+| Published > 2022-06-27T20:15Z
|+| Data type > CVE
|+| Data format > MITRE
|+| Description > {[{en Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subject to an authenticated Stored XSS in Administration. Users are advised to upgrade. There are no known workarounds for this issue.}]}
|+| CVE impact > {{{ 0 } 0 0} {{ 0} 0 0 false false false false false}}
there is another option and that is simple to use tor to reach the database
thats holds the CVE information, this option is `engine tcve` simply just using
a proxy to reach and pull data from the database.
Stalk
This is the section which will talk about two options in the stalk module
- stalk hosts and stalk hosts2
both are relative to each other, the only difference is the brute forcing
method, so stalk hosts is a subset which will allow the user to set 3 or 2
octets or a network address. stalk hosts will allow the user to input 3 octets
and example is (172.217.2) and you will brute force all possible ranges and network
addresses that match anf youll get something like the following using that example
|+| 172.217.2.136 yyz08s14-in-f136.1e100.net.,mia09s18-in-f8.1e100.net.,qro04s02-in-f8.1e100.net.
|+| 172.217.2.124 iad23s72-in-f28.1e100.net.,yyz10s05-in-f28.1e100.net.
|+| 172.217.2.209 mia09s02-in-f17.1e100.net.,iad23s23-in-f209.1e100.net.
|+| 172.217.2.205 iad23s23-in-f205.1e100.net.,mia09s02-in-f13.1e100.net.
|+| 172.217.2.206 iad23s23-in-f206.1e100.net.,mia09s02-in-f14.1e100.net.
|+| 172.217.2.208 mia09s02-in-f16.1e100.net.,iad23s23-in-f208.1e100.net.
|+| 172.217.2.140 mia09s18-in-f12.1e100.net.,qro04s02-in-f12.1e100.net.,yyz08s14-in-f140.1e100.net.
the second one stalk hosts2 again does the same but you can instead of input
(172.217.2) you can do (172.217) and it will brute force all possible combinations
until it finds a server like the following output
|+| 172.217.3.58 iad23s57-in-f26.1e100.net.
|+| 172.217.3.239 lax32s01-in-f15.1e100.net.
|+| 172.217.3.239 atl14s79-in-f15.1e100.net.
|+| 172.217.1.180 iad39s04-in-f20.1e100.net.
|+| 172.217.1.180 yyz10s04-in-f20.1e100.net.
|+| 172.217.2.6 lga15s45-in-f6.1e100.net.
Proxy downloading
> fetch proxy4, fetch proxy5
both of these commands do the same thing.
what they do is download proxies and save them to
a output file you specified wether it was from using the
-o flag or by manually typing it when the program asks for it.
however the difference is proxy4 will fetch all proxies it can
for SOCKS4, proxy5 will fetch all proxies for SOCKS5
> fetch http/https/httpssl/httpsssl
like the one above all of these are similar,
specify an output file and it will download and
save proxies to that given file. fetch http/https
commands will fetch all proxies relating to a http/https
like address, there are options to also use SSL for the proxy
grabbing list. fetch htpssl and httpsssl will grab proxies
of either http or https and make sure they are specified to
just SSL, anything without SSL will not be added to the list.