Package: witnessme
WitnessMeWitnessMe is primarily a Web Inventory tool inspired byEyewitness, its also written to be extensible allowing you to create custom functionality that can take advantage of the headless browser it drives in the back-end.WitnessMe uses thePyppeteerlibrary to drive Headless Chromium.SponsorsTable of ContentsWitnessMeMotivationInstallationDockerPython PackageDevelopment InstallQuick startsFinding F5 Load Balancers Vulnerable to CVE-2020-5902Scraping Javascript Heavy WebpagesRESTful APIDeploying to the CloudGCP Cloud RunAWS ElasticBeanstalkUsage and ExamplesModes of OperationScreenshot ModeGrab ModeInteracting with the Scan DatabaseGenerating ReportsPreviewing Screenshots Directly in the TerminalCreating SignaturesMotivationAre there are a bunch of other tools that do this? Absolutely. See the following projects for alternatives (I'm sure there are more, these are the ones I've personally tried):EyewitnessGoWitnessAquatoneThe reason why I wrote WitnessMe was that none of these projects had all of the features I wanted/needed in order for them to work well within my workflow. Additionally, some of them are prone to a decent amount of installation/dependency hell.Here are some of the main features that make WitnessMe "stand out":Written in Python 3.7+Ability to parse extremely large Nessus and NMap XML filesDocker compatibleNo installation/dependency hellFull test suite! Everything is less prone to bugsCSV & HTML reportingProvides a RESTful API! Scan stuff remotely!CLI interface to view and search scan results without having to view the reports.Signature scanning (Signatures use YAML files)Preview screenshots directly in the terminal (On MacOSX/ITerm2 and some Nix terminals)Extensibly written, allowing you to add functionality that can take advantage of headless chromium.Built to be deployed to the Clouds (e.g. GCP Cloud Run , AWS ElasticBeanstalk etc...)InstallationDockerRunning WitnessMe from a Docker container is fully supported and is the easiest/recommended way of using the tool.Note: it is highly recommended to give the Docker container at least 4GB of RAM during large scans as Chromium can be a resource hog. If you keep running into "Page Crash" errors, it's because your container does not have enough memory. On Mac/Windows you can change this by clicking the Docker Task Bar Icon -> Preferences -> Resources. For Linux, refer to Docker's documentationPull the image from Docker Hub:docker pull byt3bl33d3r/witnessmeYou can then spin up a docker container, run it like the mainwitnessmescript and pass it the same arguments:docker run --rm -ti $IMAGE_ID screenshot https://google.com 192.168.0.1/24Alternatively, you can drop into a shell within the container and run the tools that way. This also allows you to execute thewmdbandwmapiscripts.docker run --rm -ti --entrypoint=/bin/sh $IMAGE_IDPython PackageWitnessMe is also available as a Python package (Python 3.7 or above is required). If you do install it this way it is extremely recommended to usepipxas it takes care of installing everything in isolated environments for you in a seamless manner.Run the following commands:python3 -m pip install --user pipxpipx install witnessmeAll of the WitnessMe scripts should now be in your PATH and ready to go.Development InstallYou really should only install WitnessMe this way if you intend to hack on the source code. You're going to Python 3.7+ andPoetry: please refer to the Poetry installation documentation in order to install it.git clone https://github.com/byt3bl33d3r/WitnessMe && cd WitnessMepoetry installQuick StartsFinding F5 Load Balancers Vulnerable to CVE-2020-5902Install WitnessMe using Docker:docker pull byt3bl33d3r/witnessmeGet the$IMAGE_IDfrom thedocker imagescommand output, then run the following command to drop into a shell inside the container. Additionally, specify the-vflag to mount the current directory inside the container at the path/transferin order to copy the scan results back to your host machine (if so desired):docker run -it --entrypoint=/bin/sh -v $(pwd):/transfer $IMAGE_IDScan your network using WitnessMe, it can accept multiple .Nessus files, Nmap XMLs, IP ranges/CIDRs. Example:witnessme screenshot 10.0.1.0/24 192.168.0.1-20 ~/my_nessus_scan.nessus ~/my_nmap_scan.xmlAfter the scan is finished, a folder will have been created in the current directory with the results. Access the results using thewmdbcommand line utility:wmdb scan_2020_$TIME/To quickly identify F5 load balancers, first perform a signature scan using thescancommand. Then search for "BIG-IP" or "F5" using theserverscommand (this will search for the "BIG-IP" and "F5" string in the signature name, page title and server header):Additionally, you can generate an HTML or CSV report using the following commands:WMDB ≫ generate_report htmlWMDB ≫ generate_report csvYou can then copy the entire scan folder which will contain all of the reports and results to your host machine by copying it to the/transferfolder.Scraping Javascript Heavy WebpagesAs of v1.5.0, WitnessMe has agrabcommand which allows you to quickly scrape Javascript heavy webpages by rendering the page first with Headless Chromium and then parsing the resulting HTML using the specified XPath (seeherefor an XPath cheatsheet).Below are a few examples to get your started.This grabs a list of all advertised domains on the144.161.160.0/23subnet fromHurricane Electric's BGP Toolkit:witnessme -d grab -x '//div[@id="dns"]/table//tr/td[2]/a/text()' https://bgp.he.net/net/144.161.160.0/23#_dnsRESTful APIAs of version 1.0, WitnessMe has a RESTful API which allows you to interact with the tool remotely.Note: Currently, the API does not implement any authentication mechanisms. Make sure to allow/deny access at the transport levelTo start the RESTful API for testing/development purposes run :wmapiThe API documentation will then be available athttp://127.0.0.1:8000/docsUvicornshould be used to enable SSL and run the API in production. Seethis dockerfilefor an example.Deploying to the Cloud (™)Since WitnessMe has a RESTful API now, you can deploy it to the magical cloud and perform scanning from there. This would have a number of benefits, including giving you a fresh external IP on every scan (More OPSEC safe when assessing attack surface on Red Teams).There are a number of ways of doing this, you can obviously do it the traditional way (e.g. spin up a machine, install docker etc..).Recently cloud service providers started offering ways of running Docker containers directly in a fully managed environment. Think of it as serverless functions (e.g. AWS Lambdas) only with Docker containers.This would technically allow you to really quickly deploy and run WitnessMe (or really anything in a Docker container) without having to worry about underlying infrastructure and removes a lot of the security concerns that come with that.Below are some of the ones I've tried along with the steps necessary to get it going and any issues I encountered.GCP Cloud RunUnfortunately, it seems like Cloud Run doesn't allow outbound internet access to containers, if anybody knows of a way to get around this please get in touchCloud Run is by far the easiest of these services to work with.This repository includes thecloudbuild.yamlfile necessary to get this setup and running.From the repositories root folder (after you authenticated and setup a project), these two commands will automatically build the Docker image, publish it to the Gcloud Container Registry and deploy a working container to Cloud Run:gcloudbuildssubmit--configcloudbuild.yaml
gcloudrundeploy--imagegcr.io/$PROJECT_ID/witnessme--platformmanagedThe output will give you a HTTPS url to invoke the WitnessMe RESTful API from :)When you're done:gcloudrunservicesdeletewitnessme
gcloudcontainerimagesdeletegcr.io/$PROJECT_ID/witnessmeAWS ElasticBeanstalkTO DOUsageThere are 3 main utilities:witnessme: is the main CLI interface.wmdb: allows you to browse the database (created on each scan) to view results and generate reports.wmapi: provides a RESTful API to schedule, start, stop and monitor scans.Modes of OperationsAs of v1.5.0 there are two main modes (commands) that thewitnessmeutility Supports:Thescreenshotcommand, you guessed it, screenshots webpages. This is the main functionality.Thegrabcommand allows you to scrape pages and quickly grab server headers.usage: witnessme [-h] [--threads THREADS] [--timeout TIMEOUT] [-d] [-v] {screenshot,grab} ...

WitnessMe!

positional arguments:
  {screenshot,grab}

optional arguments:
  -h, --help         show this help message and exit
  --threads THREADS  Number of concurrent browser tab(s) to open
                     [WARNING: This can cause huge RAM consumption if set to high values] (default: 15)
  --timeout TIMEOUT  Timeout for each connection attempt in seconds (default: 15)
  -d, --debug        Enable debug output (default: False)
  -v, --version      show program's version number and exitScreenshot Mode$witnessmescreenshot--helpusage: witnessme screenshot [-h] [-p PORTS [PORTS ...]] target [target ...]positional arguments:target                The target IP(s), range(s), CIDR(s) or hostname(s), NMap XML file(s), .Nessus file(s)optional arguments:-h, --help            show this help message and exit-p PORTS [PORTS ...], --ports PORTS [PORTS ...]Ports to scan if IP Range/CIDR is providedCan accept a mix of .Nessus file(s), Nmap XML file(s), files containing URLs and/or IPs, IP addresses/ranges/CIDRs and URLs or alternatively read from stdin.Note: WitnessMe detects .Nessus and NMap files by their extension so make sure Nessus files have a.nessusextension and NMap scans have a.xmlextensionLong story short, should be able to handle anything you throw at it:witnessme screenshot 192.168.1.0/24 192.168.1.10-20 https://bing.com ~/my_nessus_scan.nessus ~/my_nmap_scan.xml ~/myfilewithURLSandIPs$catmy_domain_list.txt|witnessmescreenshot-If an IP address/range/CIDR is specified as a target, WitnessMe will attempt to screenshot HTTP & HTTPS pages on ports 80, 8080, 443, 8443 by default. This is customizable with the--portargument.Once a scan is completed, a folder with all the screenshots and a database will be in the current directory, pointwmdbto the folder in order to see the results.wmdb scan_2019_11_05_021237/Grab Mode$witnessmegrab--helpusage: witnessme grab [-h] [-x XPATH | -l] target [target ...]positional arguments:target                The target IP(s), range(s), CIDR(s) or hostname(s), NMap XML file(s), .Nessus file(s)optional arguments:-h, --help            show this help message and exit-x XPATH, --xpath XPATHXPath to use-l, --links           Get all linksThegrabsubcommand allows you to render Javascript heavy webpages and scrape their content using XPaths. See thissectionfor some examples.Interacting with the Scan DatabaseOnce a scan is completed (using thescreenshotmode), a folder with all the screenshots and a database will be in the current directory, pointwmdbto the folder in order to see the results.wmdb scan_2019_11_05_021237/This will drop you into the WMDB CLI menu.Pressing tab will show you the available commands and a help menu:Theserversandhostscommands in thewmdbCLI accept 1 argument. WMCLI is smart enough to know what you're trying to do with that argumentServer CommandNo arguments will show all discovered servers. Passing it an argument will search thetitleandservercolumns for that pattern (it's case insensitive).For example if you wanted to search for all discovered Apache Tomcat servers:servers tomcatorservers 'apache tomcat'Similarly if you wanted to find servers with a 'login' in the title:servers loginHosts CommandNo arguments will show all discovered hosts. Passing it an argument will search theIPandHostnamecolumns for that pattern (it's case insensitive). If the value corresponds to a Host ID it will show you the host information and all of the servers discovered on that host which is extremely useful for reporting purposes and/or when targeting specific hosts.Signature ScanYou can perform a signature scan on all discovered services using thescancommand.Generating ReportsYou can use thegenerate_reportcommand in thewmdbcli to generate reports in HTML or CSV format. To generate a HTML report simply rungenerate_reportwithout any arguments. Here's an example of what it'll look like:To generate a CSV report:WMDB ≫ generate_report csvThe reports will then be available in the scan folder.Preview Screenshots Directly in the TerminalNote: this feature will only work if you're on MacOSX and using ITerm2You can preview screenshots directly in the terminal using theshowcommand:Writing SignaturesIf you run into a new webapp write a signature for it! It's beyond simple and they're all in YAML!Don't believe me? Here's the AirOS signature (you can find them all in thesignatures directory):credentials:-password:ubntusername:ubntname:AirOSsignatures:-airos_logo.png-form enctype="multipart/form-data" id="loginform" method="post"-align="center" class="loginsubtable"-function onLangChange()# AirOS ubnt/ubntYup that's it. Just plop it in the signatures folder and POW! Done.