Sn1per Offensive Security Platform

After installation, you can perform a basic scan using the sniper command. Results (loot) are stored in /usr/share/sniper/loot/<workspace>/.

sudo bash install.sh
sniper -t example.com -m normal

Sn1per supports Docker-first deployment. You can use Docker Compose to spin up environments based on different OS images like Kali Linux or BlackArch.

Note: Running the containers requires --privileged mode for full functionality.

# Kali Linux base
sudo docker compose up
sudo docker run --privileged -it sn1per-kali-linux /bin/bash

# BlackArch base
sudo docker compose -f docker-compose-blackarch.yml up
sudo docker run --privileged -it sn1per-blackarch /bin/bash

To install the Community Edition on a Linux distribution, clone the repository and run the installation script with root privileges. Sn1per installs to /usr/share/sniper.

If you wish to skip the confirmation prompt during installation, use the force flag.

git clone https://github.com/1N3/Sn1per.git
cd Sn1per
sudo bash install.sh

# To skip confirmation prompts:
sudo bash install.sh force

The github-subdomains.py tool searches GitHub code via the GitHub API to identify subdomains associated with a specific domain. It uses provided authentication tokens to query the API and parses the results using regular expressions to extract potential subdomains.

To use the tool, you must provide a GitHub authentication token and the target domain. You can optionally extend the search pattern or request that the source URL be displayed alongside each found subdomain.

The pyText2Pdf utility is a Python script that converts plain text files into Adobe Acrobat PDF files. It supports custom page breaks, font settings, and various paper sizes.

By default, if no output file is specified with -o, the script appends .pdf to the input filename.

Basic Usage:

python pyText2pdf.py input_file.txt

When useContextForScan is set to True, you can configure advanced scanning scenarios including session management and authentication.

Session Management Options:

• cookieBasedSessionManagement
• httpAuthSessionManagement

Authentication Methods:

• manualAuthentication
• scriptBasedAuthentication (Requires authScriptName, authScriptEngine, and authScriptFileName)
• httpAuthentication
• formBasedAuthentication (Requires authParams in x-www-form-urlencoded format)

User Creation: If createUser is True, you must provide a userList containing dictionaries with name and credentials (in x-www-form-urlencoded format).

The webscreenshot.py CLI tool captures screenshots of websites using various renderers (PhantomJS, Chrome, or Chromium). It supports single URLs or batch processing via an input file, parallel execution with multiple workers, and various HTTP/Proxy configurations.

Basic Usage:

python webscreenshot.py [options] URL
# OR
python webscreenshot.py [options] -i <INPUT_FILE>

If useScanPolicy is True, you can customize the active scan behavior.

Key Options:

• scanPolicyName: The name of the policy to use.
• isWhiteListPolicy: If True, all scanners are disabled except those explicitly listed in ascanIds. If False, all scanners are enabled except those in ascanIds.
• ascanIds: A list of integer IDs for specific active scanners to use.
• alertThreshold: The sensitivity of alerts. Values: Low, Medium, High.
• attackStrength: The intensity of the attack. Values: Low, Medium, High, Insane.

useScanPolicy = True
scanPolicyName = 'SQL Injection and XSS'
isWhiteListPolicy = False
ascanIds = [40018, 40019, 40020, 40021, 40022, 40024, 90018, 40012, 40014, 40016, 40017]
alertThreshold = 'Medium'
attackStrength = 'Low'

The tool requires GitHub authentication tokens to perform searches. You can provide them in two ways:

1. CLI Argument: Pass a comma-separated list of tokens using the -t or --token flag.
2. Tokens File: Create a file named .tokens in the same directory as the github-subdomains.py script. Each token should be on a new line. If the -t flag is not provided, the script will automatically attempt to load tokens from this file.

You can deploy the Sn1per environment using Docker Compose. The configuration defines a kali-linux service built from the local Dockerfile. The setup includes a default logging configuration (x-logging) that uses the json-file driver with a maximum log size of 40m and a maximum of 10 log files to prevent disk exhaustion.

version: '3.9'

x-logging: &default-logging
  options:
    max-size: "40m"
    max-file: "10"
  driver: json-file

services:
  kali-linux:
    container_name: kali-linux
    build:
      context: .
      dockerfile: Dockerfile

Sn1per provides various scan modes via the -m flag to tailor the reconnaissance and exploitation workflow.

Common modes include:

• normal: Standard scanning.
• stealth: Stealthy scanning mode.
• discover: Discovery mode for CIDR ranges.
• port: Scan specific ports.
• web: Web mode (ports 80 + 443 only).
• webscan: HTTP webscan mode.
• airstrike: High-intensity mode.
• nuke: Full-scale automated workflow (OSINT, Recon, Brute-force, etc.).
• massportscan, massweb, masswebscan, massvulnscan: Mass scanning modes for target lists.