🍩
HackBook.io
  • Pentesting Pocket Book for hackers and developers.
  • Reconnaissance
    • Internal Recon Basics
    • OSINT
      • Infrastructure
      • Recon-ng
      • Users
      • Google Dorks
    • Active Scanning
      • NMAP
        • NSE
          • reconnoitre
        • NMap Evasion
      • NC Scan
      • Finger Printing
    • Web Server OSINT
      • WhatWeb
      • Subdomains
      • Directory & File Enumeration
        • Enumeration
          • GoCutty
          • gobuster
          • Dirb
          • nikto
        • Fuzzing
        • Crawling
  • Web Application Hacking
    • Web 101
      • Clients
      • Servers
      • Encodings
    • Web Hacking Techniques
      • SOP
      • Open Redirect
      • File & Resource Attacks
        • Directory Traversal
          • Dir Traversal Fuzzer
        • LFI
        • RFI
        • Unrestricted File Uploads
      • XSS
        • DOM
        • Stored
        • Reflected
        • Blind
        • Self XSS
      • XXE
        • XXE Payloads
      • XPath
      • SSRF
      • CSRF
      • SQLi
        • SQL Basics
        • Securing SQL
        • Hacking SQL
          • sqlmap
          • In-Band
          • Error Based
          • Blind
      • Authorization
      • Session Hijacking
      • Command Injection
      • Insecure Deserialization
      • File Uploads
        • File Upload Mitigations
      • HPP
      • Click Jacking
        • Adobe SWF Investigator
      • HTTP Response Splitting
      • Flash 101
        • Flash Hacking
      • HTML5
        • WebSockets
        • CORS
          • iframe
          • Headers
    • Web Hacking Procedures
      • Captcha
      • Username Generation
      • Username Enumeration
      • Inhouse WebApps
      • SSL Cert Generation
      • CMS
        • WordPress
        • Joomla
      • Popular Exploits
        • Bludit CMS
        • ShellShock
        • WebDav
  • Weaponization
    • Buffer Overflows (BOF)
      • DSBOFG
        • Scripts
  • Initial Access
    • 😈Services
      • Finger
      • SNMP
      • LDAP
      • SMTP
      • NFS
      • RPC
        • RPCBind
      • RDP
      • SQL
        • NoSQL
      • POP3
      • Samba
      • SMB
      • SSH
      • Telnet
      • NetBios
      • VOIP/SIP
      • DNS
        • DNS Lookups
        • Zone Transfer
        • SubDomain Enums
        • dnsdumpster
    • 😈Shells
      • Powercat
      • Odd Shells
      • Troubleshoot
      • TTY/PTTY
  • Persistence
    • File Transfers
      • Py->Exe->Txt
      • Cross compile example
    • Backdoors
  • Privilege Escalation
    • Universal Escalation
    • Windows Escalation
      • Automated
      • Popular Exploits
        • ActiveXObject to Wscript RCE
        • Macros
        • Object Linking
    • Linux Escalation
      • Automated
    • Passwords
      • John
      • Medusa
      • Cewl
      • ncrack
      • Crunch
      • Hydra
      • MITM
      • Responder
        • SAM
          • pwdump and fgdump
          • Pass-the-hash
      • Crack the hash
      • NTLM
  • Network Discovery
    • Network Traffic
      • tcpdump
    • Internal Discovery
  • Collection and Staging
    • Collection
      • File types
  • Hacking Objectives
    • Non Kinetic War (Quick Guide)
  • Procedures
    • Bash Guide
    • Active Directory
    • Crypto 101
    • Forensics
  • Glossary
  • Hacking Frameworks
    • Metasploit
      • msfvenom
    • Dsnif
  • ThreatModeling
    • Threat Modeling Overview
  • Certifications
    • VMDR
      • Qualys Asset Management
      • Qualys Vulnerability Management
      • Qualys Threat Prioritization
      • Qualys Response (Patch Deployment)
    • OSCP Cheat Sheet
  • RF - Radio Frequency
    • Ham Technician
Powered by GitBook
On this page
  • GoCutty is a tool I wrote that helps with website crawling. It does the following steps:
  • CuttyCapt Alone Ex:

Was this helpful?

  1. Reconnaissance
  2. Web Server OSINT
  3. Directory & File Enumeration
  4. Enumeration

GoCutty

GoCutty is a tool I wrote that helps with website crawling. It does the following steps:

  • Runs a gobuster directory enumeration scan

  • Runs cuttycapt and takes webpage screenshots using the gobuster output

  • Then creates an HTML page for you to quickly open and view the tooling output of webpages in the site.

#!/bin/bash
#Created by Prescott Rowe
#Usage: ./script.sh
echo "-------Gobuster meets cutycapt-----"
echo "Your files will be in the gocuty folder. Also make sure to edit the gobuster command on line 11 to your preference."
echo "Enter your target URL/IP:"

read scan
echo "Scanning $scan:"
rm -r gocuty/ 2>/dev/null
mkdir gocuty

gobuster dir -t 50 -w /usr/share/seclists/Discovery/Web-Content/common.txt -x .txt,.php,.html,.yml -u $scan -e | tee ./gocuty/found.txt;
i=0
echo "<HTML><BODY><BR>" > ./gocuty/gocuty.html
for url in $(cat ./gocuty/found.txt |grep "Status: 200\|Status: 204\|Status: 301\|Status: 302\|Status: 307\|Status: 403" |cut -d" " -f1);do
	((i++))
	cutycapt --url=$url --out=./gocuty/$i.png
	echo "<b>"$url":</b> <BR><IMG SRC=\""$i"".png"\" width=600 border="6"><BR><BR><BR>" >> ./gocuty/gocuty.html
done
echo "</BODY></HTML>" >> ./gocuty/gocuty.html

Sample output:

Also prints the fetched URL now

CuttyCapt Alone Ex:

cutycapt --url=www.aa.com --out=aa.jpeg --user-agent="Mozilla/5.0 (Linx; Android 4.4.2; SAMSUNG-SM-G900A Build/KOT49H) AppleWebKit/537.36 (KHTML, like Geko) Chrome/45.0.2454.94 Mobile Safari/537.36"

PreviousEnumerationNextgobuster

Last updated 3 years ago

Was this helpful?

The HTML page