Scilla – Information Gathering Tool DNS / Subdomains / Ports / Directories Enumeration

Example

Installation

• First of all, clone the repo locally
  • git clone https://github.com/edoardottt/scilla.git
• Scilla has external dependencies, so they need to be pulled in:
  • go get
• Linux (Requires high perms, run with sudo)
  • make linux
  • make unlinux
• Windows (executable works only in scilla folder. Alias?)
  • make windows or .\make.bat windows (on powershell)
  • make unwindows or .\make.bat unwindows (on powershell)
• Other commands:
  • make fmt run the golang formatter.
  • make update Update.
  • make remod Remod.
  • make test runs the tests.

Get Started

scilla help prints the help in the command line.

usage: scilla subcommand { options }

	Available subcommands:
		- dns -target [-o output-format] <target (URL)> REQUIRED
		- subdomain [-w wordlist] [-o output-format] [-i ignore status codes] -target <target (URL)> REQUIRED
		- port [-p <start-end>] [-o output-format] -target <target (URL/IP)> REQUIRED
		- dir [-w wordlist] [-o output-format] [-i ignore status codes] -target <target (URL/IP)> REQUIRED
		- report [-p <start-end>]
			 [-ws subdomains wordlist]
			 [-wd directories wordlist]
			 [-o output-format]
			 [-id ignore status codes in directories scanning]
			 [-is ignore status codes in subdomains scanning]
			 -target <target (URL/IP)> REQUIRED
		- help
		- examples

Examples

• DNS enumeration:
  • scilla dns -target target.domain
  • scilla dns -target -o txt target.domain
  • scilla dns -target -o html target.domain
• Subdomains enumeration:
  • scilla subdomain -target target.domain
  • scilla subdomain -w wordlist.txt -target target.domain
  • scilla subdomain -o txt -target target.domain
  • scilla subdomain -o html -target target.domain
  • scilla subdomain -i 400 -target target.domain
  • scilla subdomain -i 4** -target target.domain
• Directories enumeration:
  • scilla dir -target target.domain
  • scilla dir -w wordlist.txt -target target.domain
  • scilla dir -o txt -target target.domain
  • scilla dir -o html -target target.domain
  • scilla dir -i 500,401 -target target.domain
  • scilla dir -i 5**,401 -target target.domain
• Ports enumeration:
  • Default (all ports, so 1-65635) scilla port -target target.domain
  • Specifying ports range scilla port -p 20-90 -target target.domain
  • Specifying starting port (until the last one) scilla port -p 20- -target target.domain
  • Specifying ending port (from the first one) scilla port -p -90 -target target.domain
  • Specifying single port scilla port -p 80 -target target.domain
  • Specifying output format (txt)scilla port -o txt -target target.domain
  • Specifying output format (html)scilla port -o html -target target.domain
• Full report:
  • Default (all ports, so 1-65635) scilla report -target target.domain
  • Specifying ports range scilla report -p 20-90 -target target.domain
  • Specifying starting port (until the last one) scilla report -p 20- -target target.domain
  • Specifying ending port (from the first one) scilla report -p -90 -target target.domain
  • Specifying single port scilla report -p 80 -target target.domain
  • Specifying output format (txt)scilla report -o txt -target target.domain
  • Specifying output format (html)scilla report -o html -target target.domain
  • Specifying directories wordlist scilla report -wd dirs.txt -target target.domain
  • Specifying subdomains wordlist scilla report -ws subdomains.txt -target target.domain
  • Specifying status codes to be ignored in directories scanning scilla report -id 500,501,502 -target target.domain
  • Specifying status codes to be ignored in subdomains scanning scilla report -is 500,501,502 -target target.domain
  • Specifying status codes classes to be ignored in directories scanning scilla report -id 5**,4** -target target.domain
  • Specifying status codes classes to be ignored in subdomains scanning scilla report -is 5**,4** -target target.domain

Contributing

Just open an issue/pull request. See also CONTRIBUTING.md and CODE OF CONDUCT.md

Help me building this!

A special thanks to danielmiessler, using those lists.

To do:

• Tests
• Recursive Web crawling for subdomains and directories
• Check input and if it’s an IP try to change to hostname when dns or subdomain is active
• Tor support
• JSON report output
• XML report output
• (report mode) In all the subdomains found enumerates ports???
• Proxy support
• Ignore responses by status codes (partially done, to do with *, e.g. -i 4**)
• HTML output
• Build an Input Struct and use it as parameter
• Output color
• Subdomains enumeration
• DNS enumeration
• Subdomains enumeration
• Port enumeration
• Directories enumeration
• TXT output

Download: https://github.com/edoardottt/scilla

Please follow and like us: