./EchoPwn.sh domain.com                 	      //For Default Scan
./EchoPwn.sh domain.com -nmap            	      //To run nmap on your results
./EchoPwn.sh domain.com -arjun   		      //To run arjun on your results
./EchoPwn.sh domain.com -photon          	      //To run photon on each subdomain
./EchoPwn.sh domain.com -knock                	      //To bruteforce subdomain using knockpy
./EchoPwn.sh domain.com -nmap -arjun -photon -kncok   //For Full Scan

Output will be saved in EchoPwn/domain.com/ directory

install.sh makes environment to run EchoPwn.sh EchoPwn.sh creates a directory EchoPwn/domain_name in current working directory.

1. Subdomain Enumeration

   • Sublist3r
   • crt.sh
   • amass
   • subfinder
   • assetfinder
   • aquatone-discover
   • findomain
   • github-subdomains
   • custom bruteforcer with subdomains.txt as input file.
   • Optional: knockpy

2. Checking for live subdomains

   • httprobe

3. Screenshots

   • aquatone

4. Directory Bruteforce

   • dirsearch

5. Optional

   • -nmap     Probe open ports to determine service/version info
   • -arjun      Scans for hidden parameters on live hosts
   • -photon    Crawls all live hosts [takes time and creates lots of files]
   • -knock     Bruteforce subdomains [takes time and saves output in current working directory (in json format)]

6. Slack Notification

   • WebHook URL placed in tokens.txt will be used to notify the user once the script has finished running.

Final list of subdomains will be present in EchoPwn/domain_name directory. Outputs corresponding to the tools will also be present in the same directory.

1. go
2. gem

Then run:

./install.sh

Some Tools require manual downloading of pre-built binaries (or build them yourself):

1. Subfinder
2. Assestfinder
3. Aquatone

Download (or build) and place these binaries in the EchoPwn directory.

Apart from the tokens required by individual tools, this script requires 4 additional values:

• FaceBook Token
• Github Token
• Spyse Token
• VirusTotal Token
• Slack WebHook URL

Place these values in tokens.txt before running EchoPwn.sh

NOTE

1. If you face Import error (Queue) while running altdns, you have to manually change main.py file mentioned in the error. Do the following change Before: Import Queue from Queue as Queue After: Import queue from Queue as Queue

2. To set GOPATH, use the following command: export $GOPATH=~/go/bin

• Gitrob & more...

Suggestions are welcomed. Mail us at: [email protected]

OWASP, ProjectDiscovery, Tom Hudson, Michael Henriksen, Gwendal Le Coguic, Eduard Tolosa, B. Blechschmidt, ProjectAnte, Somdev Sangwan, Mauro Soria, Gianni Amato, Ahmed Aboul-Ela