overflow-scanner

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>overflow.docs</title> <link href="style.css" rel="stylesheet"> </head> <body> <h1>overflow.docs</h1> <h2>How to use</h2> Overflow is based on node graphs, which are "blocks" (e.g. nodes) connected with each other. Each node gets something as input from nodes connected from the left, does something with it and passes the output along to other nodes, connected from the right. To add a node, double-click empty space in your workspace. Then you can choose what type of node you want to add, set up the parameters, etc. To connect nodes between each other, drag your mouse from a right-side connector to a left-side connector. Please note: some modules require the corresponding tools to be installed an in PATH. If you don't have them installed in your system, the modules will not work and will throw an error! On the bottom panel, there are logs and controls on the left side and the tasks view on the right side. The logs display all vulnerable targets, errors and messages. The tasks view displays all currently running tasks, such as scanning or auditing. As for the controls... <ul> <li>Run - runs the current workspace, starting from the input nodes (such as <code>overflow/const</code> or <code>overflow/crtsh</code>)</li> <li>Clear logs - clears the logs</li> <li>Save - saves the workspace to a <code>.json</code> file</li> <li>Load - loads the workspace from a <code>.json</code> file</li> <li>Docs - opens this page</li> </ul> <h2>Nodes documentation</h2> <details> <summary><code>overflow/const</code></summary> Allows you to paste in or type in a raw list of targets to scan. Targts are separated by newlines. </details> <details> <summary><code>overflow/log</code></summary> Logs a target as vulnerable with an optional custom messsage. The logged target will appear in the "Logs" section. </details> <details> <summary><code>overflow/hasport</code></summary> Takes in a list of targets as input and only outputs those targets that have a port in them. </details> <details> <summary><code>overflow/iprange</code></summary> Takes an IP and a mask, generates a CIDR notation with them (e.g. <code>IP = 192.168.1.0, MASK = 24 -> CIDR = 192.168.1.0/24</code>) and outputs all IPs for that notation. Note: Please keep in mind that all IPs are stored in memory at once as strings, so please do not run this with masks lower than 12. </details> <details> <summary><code>overflow/nmap</code></summary> Takes in a list of targets as input and outputs targets with open ports using nmap (installed separately). Example: <code>192.168.1.45 -> 192.168.1.45:80, 192.168.1.45:22</code> </details> <details> <summary><code>overflow/stripports</code></summary> Takes in a list of targets with ports as input and outputs targets without their ports. Example: <code>192.168.1.45:80 -> 192.168.1.45</code> </details> <details> <summary><code>overflow/crtsh</code></summary> Makes a request to <a href="https://crt.sh">crt.sh</a> and returns unique subdomains. </details> <details> <summary><code>overflow/stripproto</code></summary> Takes in a list of targets with protocols as input and outputs targets without their protocols. Example: <code>ftp://192.168.1.45 -> 192.168.1.45</code> </details> <details> <summary><code>overflow/prefixsuffix</code></summary> Adds a prefix and a suffix to a target, can be useful for adding protocols, ports or paths. </details> <details> <summary><code>overflow/metasploitcheck</code></summary> Checks a target using metasploit (installed separately) with the specified exploit. Metasploit is launched with overflow if present on the system. </details> <details> <summary><code>overflow/lograw</code></summary> Logs text as-is. </details> <details> <summary><code>overflow/strippaths</code></summary> Strips paths from targets. </details> <details> <summary><code>overflow/burp</code></summary> Connects to a running Burp Suite (installed separately) instance and scans a webpage using a preset configuration (created in Burp Suite). Requires a valid URL as input and Burp Suite to be set up properly (google "burp suite rest api"). </details> <details> <summary><code>overflow/sublist3r</code></summary> Like <code>overflow/crtsh</code>, but using Sublist3r (installed separately). The path to Sublist3r can be customized. </details> <details> <summary><code>overflow/zap</code></summary> Like <code>overflow/burp</code>, but connects to a running ZAP instance (installed separately). To set up ZAP, go to Settings -> API and generate an API key. Has two modes: <code>spider</code> and <code>scan</code>. Please note that unless a URL was detected by ZAP with <code>spider</code>, <code>scan</code> can't scan it. Also, <code>spider</code> only returns targets, while <code>scan</code> only returns logs. </details> <details> <summary><code>overflow/sqlmap</code></summary> Takes a valid URL as an input and runs sqlmap (installed separately) with customizable parameters. The path to sqlmap can be customized. </details> <details> <summary><code>overflow/hasproto</code></summary> Takes in a list of targets as input and only outputs those targets that have a protocol in them. </details> <details> <summary><code>overflow/haspath</code></summary> Takes in a list of targets as input and only outputs those targets that have a path in them. </details> <details> <summary><code>overflow/regex</code></summary> Takes in a list of targets as input and only outputs those targets that match a set regex pattern. </details> <details> <summary><code>overflow/regexmatch</code></summary> Takes in a list of targets as input and outputs regex matches from the inputs. </details> <details> <summary><code>overflow/regexreplace</code></summary> Takes in a list of targets as input and outputs those targets with text matching set regex pattern replaces with set text. </details> <details> <summary><code>overflow/deduplicate</code></summary> Deduplicates a list of targets. Only works when given a list of targets, not when targets are sent individually. </details> <details> <summary><code>overflow/sortabc</code></summary> Alphabetic sorting of targets. </details> <details> <summary><code>overflow/dns</code></summary> DNS resolver. Resolves to both v4 and v6 IPs. </details> <details> <summary><code>overflow/dnsreverse</code></summary> Reverse DNS resolver. Resolves to domains. <a href="https://ipinfo.io">Uses ipinfo.io</a> </details> <details> <summary><code>overflow/file</code></summary> Appends the input to the specified file. </details> <details> <summary><code>overflow/logpost</code></summary> Sends the targets to an HTTP endpoint using POST. It sets the <code>User-Agent</code> header to <code>overflow</code> and sends a JSON array. </details> </body> </html>