Setup · published

Initial Recon Script

Ein Bash-Helper für automatisierte Initial-Scans, saubere Projektstruktur und strukturierte Nmap-Outputs.

BashNmapReconPentestTools

Automatisierter Initial-Scan:

IP und Namen angeben, anschließend wird ein Verzeichnis erstellt und der Scan-Output dort abgelegt.

Es wird wie folgt gescannt:


Full TCP Port Scan
Ziel: Ermittelt schnell alle offenen TCP-Ports des Targets.

  nmap -p- --min-rate 10000 -T4 -v -n 

Service Enumeration Scan
Ziel: Analysiert die gefundenen Ports auf Services, Versionen, Standard-Scripts, OS-Informationen und Traceroute.

  nmap -sV -sC -O --traceroute -T4 -v


Es wird foglgende Basis Struktur erzeugt:


TARGET/
├── recon/
├── scans/
│   ├── <host>-initial.nmap
│   ├── <host>-ports.txt
│   ├── <host>-services.nmap
│   └── hosts/  # nur bei CIDR-Scans
├── loot/
├── web/
├── shells/
├── privesc/
├── notes/
│   └── master_notes.md
├── reports/
│   └── final_walkthrough.md
├── screenshots/
├── timeline.txt
└── credentials.txt


Ich habe zwei Versionen erstellt:

initscan.sh = Projekt vorbereiten + scannen

quickscan.sh = nur scannen


Script 1 = initscan.sh

#!/usr/bin/env bash
set -euo pipefail

usage() {
  echo "Usage: $0 -i <IP|CIDR> -n <TARGET_NAME>"
  echo
  echo "Options:"
  echo "  -i    IP-Adresse ODER CIDR des Targets (z.B. 10.129.163.96 oder 10.10.110.0/24)"
  echo "  -n    Name des Targets (z.B. lame oder offshore)"
  echo "  -h    Hilfe anzeigen"
  exit 1
}

# === Argumente parsen ===
IP=""
TARGET=""

while getopts "i:n:h" opt; do
  case "$opt" in
    i) IP="$OPTARG" ;;
    n) TARGET="$OPTARG" ;;
    h) usage ;;
    *) usage ;;
  esac
done

if [[ -z "${IP}" || -z "${TARGET}" ]]; then
  echo "[!] IP/CIDR und TARGET-Name sind Pflicht."
  usage
fi

# === Utils ===
is_cidr() {
  [[ "$1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[12][0-9]|3[0-2])$ ]]
}

sanitize_name() {
  # safe for filenames: replace '/' -> '_', spaces -> '_'
  local s="$1"
  s="${s//\//_}"
  s="${s// /_}"
  echo "$s"
}

extract_up_hosts_gnmap() {
  # Reads a .gnmap file and prints IPs of hosts that are Up
  # Example line: "Host: 10.10.110.12 ()  Status: Up"
  awk '/Status: Up/{for(i=1;i<=NF;i++) if($i ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/) print $i}' "$1" | sort -u
}

scan_single_host() {
  local host="$1"
  local host_safe
  host_safe="$(sanitize_name "$host")"

  echo
  echo "[*] ===== Host: $host ====="

  echo "[*] Quick Portscan auf allen TCP-Ports ..."
  nmap -p- --min-rate 10000 -T4 -v -n --open "$host" -oN "${host_safe}-initial.nmap"

  echo "[*] Offene Ports extrahieren -> ${host_safe}-ports.txt ..."

  awk -F/ '/^[0-9]+\/tcp/ {print $1}' "${host_safe}-initial.nmap" \
    | paste -sd, - > "${host_safe}-ports.txt" || true

  local PORTS=""
  PORTS="$(cat "${host_safe}-ports.txt" || true)"

  echo "[*] Ports: ${PORTS}"

  if [[ -z "${PORTS}" ]]; then
    echo "[!] Keine offenen Ports gefunden für ${host}, skip."
    return 0
  fi

  echo "[*] Service Scan (-sV -sC -O --traceroute) ..."
  nmap -sV -sC -O --traceroute -T4 -v -n -p "$PORTS" -oN "${host_safe}-services.nmap" "$host"

  echo "[+] Host fertig: $host"
}

# === Root-Hinweis für OS Detection ===
if [[ "${EUID}" -ne 0 ]]; then
  echo "[!] Hinweis: OS Detection (-O) funktioniert zuverlässig nur mit sudo/root."
fi

# === Basisverzeichnis ===
TARGET_SAFE="$(sanitize_name "$TARGET")"
BASE="./${TARGET_SAFE}"

mkdir -p "$BASE"/{recon,scans,loot,web,shells,privesc,notes,reports,screenshots}

touch "$BASE"/notes/master_notes.md
touch "$BASE"/reports/final_walkthrough.md
touch "$BASE"/timeline.txt
touch "$BASE"/credentials.txt

# Alle Nmap-Scans landen in scans/
cd "$BASE/scans" || { echo "[!] Konnte nicht nach $BASE/scans wechseln"; exit 1; }

# === CIDR oder Single IP? ===
if is_cidr "$IP"; then
  SAFE_NET="$(sanitize_name "$IP")"

  echo "[*] CIDR erkannt: $IP"
  echo "[*] Host Discovery (-sn) auf $IP ..."

  nmap -sn -T4 -n "$IP" -oN "${SAFE_NET}-hosts.nmap" -oG "${SAFE_NET}-hosts.gnmap"

  mapfile -t HOSTS < <(extract_up_hosts_gnmap "${SAFE_NET}-hosts.gnmap")

  if (( ${#HOSTS[@]} == 0 )); then
    echo "[!] Keine Hosts up gefunden in $IP. Fertig."
    exit 0
  fi

  echo "[*] Up Hosts (${#HOSTS[@]}):"
  printf '    - %s\n' "${HOSTS[@]}"

  mkdir -p "hosts"

  for h in "${HOSTS[@]}"; do
    host_safe="$(sanitize_name "$h")"
    mkdir -p "hosts/${host_safe}"

    (
      cd "hosts/${host_safe}" || exit 1
      scan_single_host "$h"
    )
  done

  echo
  echo "[+] Fertig. Übersicht:"
  echo "    - ${BASE}/scans/${SAFE_NET}-hosts.nmap"
  echo "    - ${BASE}/scans/${SAFE_NET}-hosts.gnmap"
  echo "    - ${BASE}/scans/hosts/<host>/<host>-initial.nmap"
  echo "    - ${BASE}/scans/hosts/<host>/<host>-ports.txt"
  echo "    - ${BASE}/scans/hosts/<host>/<host>-services.nmap"

else
  echo "[*] Single Host erkannt: $IP"

  scan_single_host "$IP"

  echo
  echo "[+] Fertig. Files in ${BASE}/scans:"
  ls -1
fi

printf "[%s] Initial scan completed for target '%s' against '%s'\n" "$(date '+%Y-%m-%d %H:%M:%S')" "$TARGET_SAFE" "$IP" >> ../timeline.txt


Script2 = quickscan.sh


#!/usr/bin/env bash
set -euo pipefail

usage() {
  echo "Usage: $0 -i <IP|CIDR>"
  echo
  echo "Options:"
  echo "  -i    IP-Adresse ODER CIDR des Targets, z.B. 10.129.163.96 oder 10.10.110.0/24"
  echo "  -h    Hilfe anzeigen"
  exit 1
}

IP=""

while getopts "i:h" opt; do
  case "$opt" in
    i) IP="$OPTARG" ;;
    h) usage ;;
    *) usage ;;
  esac
done

if [[ -z "${IP}" ]]; then
  echo "[!] IP/CIDR ist Pflicht."
  usage
fi

is_cidr() {
  [[ "$1" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/([0-9]|[12][0-9]|3[0-2])$ ]]
}

sanitize_name() {
  local s="$1"
  s="${s//\//_}"
  s="${s// /_}"
  echo "$s"
}

extract_up_hosts_gnmap() {
  awk '/Status: Up/{for(i=1;i<=NF;i++) if($i ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/) print $i}' "$1" | sort -u
}

scan_single_host() {
  local host="$1"
  local host_safe
  host_safe="$(sanitize_name "$host")"

  echo
  echo "[*] ===== Host: $host ====="

  echo "[*] Quick Portscan auf allen TCP-Ports ..."
  nmap -p- --min-rate 10000 -T4 -v -n --open "$host" -oN "${host_safe}-initial.nmap"

  echo "[*] Offene Ports extrahieren -> ${host_safe}-ports.txt ..."

  awk -F/ '/^[0-9]+\/tcp/ {print $1}' "${host_safe}-initial.nmap" \
    | paste -sd, - > "${host_safe}-ports.txt" || true

  local PORTS=""
  PORTS="$(cat "${host_safe}-ports.txt" || true)"

  echo "[*] Ports: ${PORTS}"

  if [[ -z "${PORTS}" ]]; then
    echo "[!] Keine offenen Ports gefunden für ${host}, skip."
    return 0
  fi

  echo "[*] Service Scan (-sV -sC -O --traceroute) ..."
  nmap -sV -sC -O --traceroute -T4 -v -n -p "$PORTS" -oN "${host_safe}-services.nmap" "$host"

  echo "[+] Host fertig: $host"
}

if [[ "${EUID}" -ne 0 ]]; then
  echo "[!] Hinweis: OS Detection (-O) funktioniert zuverlässig nur mit sudo/root."
fi

if is_cidr "$IP"; then
  SAFE_NET="$(sanitize_name "$IP")"

  echo "[*] CIDR erkannt: $IP"
  echo "[*] Host Discovery (-sn) auf $IP ..."

  nmap -sn -T4 -n "$IP" -oN "${SAFE_NET}-hosts.nmap" -oG "${SAFE_NET}-hosts.gnmap"

  mapfile -t HOSTS < <(extract_up_hosts_gnmap "${SAFE_NET}-hosts.gnmap")

  if (( ${#HOSTS[@]} == 0 )); then
    echo "[!] Keine Hosts up gefunden in $IP. Fertig."
    exit 0
  fi

  echo "[*] Up Hosts (${#HOSTS[@]}):"
  printf '    - %s\n' "${HOSTS[@]}"

  mkdir -p hosts

  for h in "${HOSTS[@]}"; do
    host_safe="$(sanitize_name "$h")"
    mkdir -p "hosts/${host_safe}"

    (
      cd "hosts/${host_safe}" || exit 1
      scan_single_host "$h"
    )
  done

  echo
  echo "[+] Fertig. Übersicht:"
  echo "    - ${SAFE_NET}-hosts.nmap"
  echo "    - ${SAFE_NET}-hosts.gnmap"
  echo "    - hosts/<host>/<host>-initial.nmap"
  echo "    - hosts/<host>/<host>-ports.txt"
  echo "    - hosts/<host>/<host>-services.nmap"

else
  echo "[*] Single Host erkannt: $IP"

  scan_single_host "$IP"

  echo
  echo "[+] Fertig. Files:"
  ls -1
fi