It's like bowling with bumpers, but you have to verbally agree to every throw. - @ippsec

For a quick introduction to SemiAutoRecon, please see the below YouTube video:

SemiAutoRecon

SemiAutoRecon is a multi-threaded network reconnaissance tool which performs semi-automated enumeration of services. It is intended as a time-saving tool for use in CTFs and other penetration testing environments (e.g. OSCP). It is most definitely not useful in real-world engagements.

The tool works by firstly performing port scans / service detection scans (with explicit permission from the user). From those initial results, the tool will launch further enumeration scans of those services using a number of different tools (with explicit permission from the user). For example, if HTTP is found, feroxbuster will be launched (as well as many others), provided the user gives permission.

Everything in the tool is highly configurable. The default configuration performs no automated exploitation to keep the tool in line with OSCP exam rules. If you wish to add semi-automatic exploit tools to the configuration, you do so at your own risk. The author will not be held responsible for negative actions that result from the mis-use of this tool.

Origin

SemiAutoRecon was inspired by three tools which the author used during the OSCP labs: Reconnoitre, ReconScan, and bscan. While all three tools were useful, none of the three alone had the functionality desired. SemiAutoRecon combines the best features of the aforementioned tools while also implementing many new features to help testers with enumeration of multiple targets.

Features

• Prompts the user before executing any command.
• Supports multiple targets in the form of IP addresses, IP ranges (CIDR notation), and resolvable hostnames. IPv6 is also supported.
• Can scan multiple targets concurrently, utilizing multiple processors if they are available.
• Advanced plugin system allowing for easy creation of new scans.
• Customizable port scanning plugins for flexibility in your initial scans.
• Customizable service scanning plugins for further enumeration.
• Suggested manual follow-up commands for when automation makes little sense.
• Ability to limit port scanning to a combination of TCP/UDP ports.
• Ability to skip port scanning phase by suppling information about services which should be open.
• Global and per-scan pattern matching which highlights and extracts important information from the noise.
• An intuitive directory structure for results gathering.
• Full logging of commands that were run, along with errors if they fail.
• A powerful config file lets you use your favorite settings every time.
• A tagging system that lets you include or exclude certain plugins.
• Global and per-target timeouts in case you only have limited time.
• Four levels of verbosity, controllable by command-line options, and during scans using Up/Down arrows.
• Colorized output for distinguishing separate pieces of information. Can be turned off for accessibility reasons.

Installation

There are three ways to install SemiAutoRecon: pipx, pip, and manually. Before installation using any of these methods, certain requirements need to be fulfilled. If you have not refreshed your apt cache recently, run the following command so you are installing the latest available packages:

sudo apt update

Python 3

SemiAutoRecon requires the usage of Python 3.7+ and pip, which can be installed on Kali Linux using the following commands:

sudo apt install python3
sudo apt install python3-pip

Supporting Packages

Several commands used in SemiAutoRecon reference the SecLists project, in the directory /usr/share/seclists/. You can either manually download the SecLists project to this directory (https://github.com/danielmiessler/SecLists), or if you are using Kali Linux (highly recommended) you can run the following commands:

sudo apt install seclists

SemiAutoRecon will still run if you do not install SecLists, though several commands may fail, and some manual commands may not run either.

Additionally the following commands may need to be installed, depending on your OS:

curl
enum4linux
feroxbuster
gobuster
impacket-scripts
nbtscan
nikto
nmap
onesixtyone
oscanner
redis-tools
smbclient
smbmap
snmpwalk
sslscan
svwar
tnscmd10g
whatweb
wkhtmltopdf

On Kali Linux, you can ensure these are all installed using the following commands:

sudo apt install seclists curl enum4linux feroxbuster gobuster impacket-scripts nbtscan nikto nmap onesixtyone oscanner redis-tools smbclient smbmap snmp sslscan sipvicious tnscmd10g whatweb wkhtmltopdf

Installation Method #1: pipx (Recommended)

It is recommended you use pipx to install SemiAutoRecon. pipx will install SemiAutoRecon in it's own virtual environment, and make it available in the global context, avoiding conflicting package dependencies and the resulting instability. First, install pipx using the following commands:

sudo apt install python3-venv
python3 -m pip install --user pipx
python3 -m pipx ensurepath

You will have to re-source your ~/.bashrc or ~/.zshrc file (or open a new tab) after running these commands in order to use pipx.

Install SemiAutoRecon using the following command:

pipx install git+https://github.com/Tib3rius/SemiAutoRecon.git

Note that if you want to run SemiAutoRecon using sudo (required for faster SYN scanning and UDP scanning), you have to use one of the following examples:

sudo env "PATH=$PATH" semiautorecon [OPTIONS]
sudo $(which semiautorecon) [OPTIONS]

Installation Method #2: pip

Alternatively you can use pip to install SemiAutoRecon using the following command:

python3 -m pip install git+https://github.com/Tib3rius/SemiAutoRecon.git

Note that if you want to run SemiAutoRecon using sudo (required for faster SYN scanning and UDP scanning), you will have to run the above command as the root user (or using sudo).

Similarly to pipx, if installed using pip you can run SemiAutoRecon by simply executing semiautorecon.

Installation Method #3: Manually

If you'd prefer not to use pip or pipx, you can always still install and execute semiautorecon.py manually as a script. From within the SemiAutoRecon directory, install the dependencies:

python3 -m pip install -r requirements.txt

You will then be able to run the semiautorecon.py script:

python3 semiautorecon.py [OPTIONS] 127.0.0.1

Upgrading

pipx

Upgrading SemiAutoRecon when it has been installed with pipx is the easiest, and is why the method is recommended. Simply run the following command:

pipx upgrade semiautorecon

pip

If you've installed SemiAutoRecon using pip, you will first have to uninstall SemiAutoRecon and then re-install using the same install command:

python3 -m pip uninstall semiautorecon
python3 -m pip install git+https://github.com/Tib3rius/SemiAutoRecon.git

Manually

If you've installed SemiAutoRecon manually, simply change to the SemiAutoRecon directory and run the following command:

git pull

Assuming you did not modify any of the content in the SemiAutoRecon directory, this should pull the latest code from this GitHub repo, after which you can run SemiAutoRecon using the semiautorecon.py script as per usual.

Plugins

A plugin update process is in the works. Until then, after upgrading, remove the ~/.config/SemiAutoRecon directory and run SemiAutoRecon with any argument to repopulate with the latest files.

If you depend on the ~/.config/SemiAutoRecon/config.toml file (i.e. you have made modifications to it) then simply remove everything in the ~/.config/SemiAutoRecon apart from the config.toml file (including the VERSION-x.x.x file).

Usage

SemiAutoRecon uses Python 3 specific functionality and does not support Python 2.

usage: semiautorecon [-t TARGET_FILE] [-p PORTS] [-m MAX_SCANS] [-mp MAX_PORT_SCANS] [-c CONFIG_FILE] [-g GLOBAL_FILE] [--tags TAGS]
                 [--exclude-tags TAGS] [--port-scans PLUGINS] [--service-scans PLUGINS] [--reports PLUGINS] [--plugins-dir PLUGINS_DIR]
                 [--add-plugins-dir PLUGINS_DIR] [-l [TYPE]] [-o OUTPUT] [--single-target] [--only-scans-dir] [--no-port-dirs]
                 [--heartbeat HEARTBEAT] [--timeout TIMEOUT] [--target-timeout TARGET_TIMEOUT] [--nmap NMAP | --nmap-append NMAP_APPEND]
                 [--proxychains] [--disable-sanity-checks] [--force-services SERVICE [SERVICE ...]] [--accessible]
                 [-v] [--version] [--curl.path VALUE] [--dirbuster.tool {feroxbuster,gobuster,dirsearch,ffuf,dirb}]
                 [--dirbuster.wordlist VALUE [VALUE ...]] [--dirbuster.threads VALUE] [--dirbuster.ext VALUE]
                 [--onesixtyone.community-strings VALUE] [--global.username-wordlist VALUE] [--global.password-wordlist VALUE]
                 [--global.domain VALUE] [-h]
                 [targets ...]

Network reconnaissance tool to port scan and automatically enumerate services found on multiple targets.

positional arguments:
  targets               IP addresses (e.g. 10.0.0.1), CIDR notation (e.g. 10.0.0.1/24), or resolvable hostnames (e.g. foo.bar) to scan.

optional arguments:
  -t TARGET_FILE, --target-file TARGET_FILE
                        Read targets from file.
  -p PORTS, --ports PORTS
                        Comma separated list of ports / port ranges to scan. Specify TCP/UDP ports by prepending list with T:/U: To scan both
                        TCP/UDP, put port(s) at start or specify B: e.g. 53,T:21-25,80,U:123,B:123. Default: None
  -m MAX_SCANS, --max-sca