Getting started with sn1per scanning [closed]

Question

I just pulled down the repository for an elite penetration testing tool call sn1per I want to use this tool to scan a list of websites. My goal is to automate the steps of a manual penetration test.

The steps to reach the point where I am at is to install the Ubuntu application on Windows 10. Then run the commands from the getting started guide from github: https://github.com/1N3/Sn1per

git clone https://github.com/1N3/Sn1per
cd Sn1per
bash install.sh

Then run

sudo sniper security.stackexchange.com

The result is

Unknown scan option security.stackexchange.com...refer to the help menu for usage details.

Answer 1

The first step to becoming an "elite pentester" - as you phrase it - is to be able to read error messages. The error message you see is that it says "Unknown scan option security.stackexchange.com". That means that it tries to interpret the string security.stackexchange.com as an option, rather than a target.

It also conveniently lists the necessary remediation step: refer to the help menu for usage details. The help menu referenced can be shown by calling sniper -h or sniper --help and will print the following:

[*] NORMAL MODE
sniper -t <TARGET>

[*] NORMAL MODE + OSINT + RECON
sniper -t <TARGET> -o -re

[*] STEALTH MODE + OSINT + RECON
sniper -t <TARGET> -m stealth -o -re

[*] DISCOVER MODE
sniper -t <CIDR> -m discover -w <WORSPACE_ALIAS>

[*] SCAN ONLY SPECIFIC PORT
sniper -t <TARGET> -m port -p <portnum>

[*] FULLPORTONLY SCAN MODE
sniper -t <TARGET> -fp

[*] WEB MODE - PORT 80 + 443 ONLY!
sniper -t <TARGET> -m web

[*] HTTP WEB PORT MODE
sniper -t <TARGET> -m webporthttp -p <port>

[*] HTTPS WEB PORT MODE
sniper -t <TARGET> -m webporthttps -p <port>

[*] HTTP WEBSCAN MODE
sniper -t <TARGET> -m webscan 

[*] ENABLE BRUTEFORCE
sniper -t <TARGET> -b

[*] AIRSTRIKE MODE
sniper -f targets.txt -m airstrike

[*] NUKE MODE WITH TARGET LIST, BRUTEFORCE ENABLED, FULLPORTSCAN ENABLED, OSINT ENABLED, RECON ENABLED, WORKSPACE & LOOT ENABLED
sniper -f targets.txt -m nuke -w <WORKSPACE_ALIAS>

[*] MASS PORT SCAN MODE
sniper -f targets.txt -m massportscan

[*] MASS WEB SCAN MODE
sniper -f targets.txt -m massweb

[*] MASS WEBSCAN SCAN MODE
sniper -f targets.txt -m masswebscan

[*] MASS VULN SCAN MODE
sniper -f targets.txt -m massvulnscan

[*] PORT SCAN MODE
sniper -t <TARGET> -m port -p <PORT_NUM>

[*] LIST WORKSPACES
sniper --list

[*] DELETE WORKSPACE
sniper -w <WORKSPACE_ALIAS> -d

[*] DELETE HOST FROM WORKSPACE
sniper -w <WORKSPACE_ALIAS> -t <TARGET> -dh

[*] GET SNIPER SCAN STATUS
sniper --status

[*] LOOT REIMPORT FUNCTION
sniper -w <WORKSPACE_ALIAS> --reimport

[*] LOOT REIMPORTALL FUNCTION
sniper -w <WORKSPACE_ALIAS> --reimportall

[*] LOOT REIMPORT FUNCTION
sniper -w <WORKSPACE_ALIAS> --reload

[*] LOOT EXPORT FUNCTION
sniper -w <WORKSPACE_ALIAS> --export

[*] SCHEDULED SCANS
sniper -w <WORKSPACE_ALIAS> -s daily|weekly|monthly

[*] USE A CUSTOM CONFIG
sniper -c /path/to/sniper.conf -t <TARGET> -w <WORKSPACE_ALIAS>

[*] UPDATE SNIPER
sniper -u|--update

The very first option, aptly named "Normal Mode" shows that you call it by specifying the -t flag. Thus, the correct way to calling the tool is sniper -t security.stackexchange.com

A word of warning...

As an elite pentester, you should be aware of two things:

1. The script is asking you to run it as root. In fact, it will refuse to run as anything but root. Did you check the contents of the script before running it? Or do you want to give anyone with a project with a catchy name permission to run their code on your machine as root?
2. You explicitly specify security.stackexchange.com as your target. I don't know if this is a placeholder or not, but in case it is not, be aware that "pentesting" a machine you do not own or have explicit permission to test is illegal in many jurisdictions. If you would like to set up a target to hone your elite pentesting skills on, I highly recommend setting up a virtual machine with DVWA or OWASP JuiceShop.