New function!!

The new GyoiThon (version 0.0.4) can list up your subdomain facing on the internet. And if the subdomain is published as a Web service, then GyoiThon executes a health check that a non-destructive vulnerability assessment.

• ex) Listing up your subdomain.
  First, you have to prepare the domain_list.csv is following:

"Domain Name"
mbsd.jp

And you execute following command.

root@kali:~/GyoiThon# python3 gyoithon.py -i --domain_list

Overview

GyoiThon is Intelligence Gathering tool for Web Server.

GyoiThon execute remote access to target Web server and identifies product operated on the server such as CMS, Web server software, Framework, Programming Language etc,. And, it can execute exploit modules to identified products using Metasploit. GyoiThon fully automatically execute above action.

GyoiThon's main features are following.

• Remote access/Fully automatic
  GyoiThon can fully automatically gather the information of target Web server using only remote access. You only execute GyoiThon once for your operation.

• Non-destructive test
  GyoiThon can gather information of target Web server using only normally access.
  But, when you use a part of option, GyoiThon execute abnormally access such as sending exploit modules.

• Gathering various information
  GyoiThon has various intelligence gathering engines such as Web crawler, Google Custom Search API, Censys, explorer of default contents, examination of cloud services etc,. By analyze gathered information using strings pattern matching and machine learning, GyoiThon can identify product/version/CVE number operated on the target web server, unnecceary html comments/debug messages, login page etc.

• Examination of real vulnerability
  GyoiThon can execute exploit modules to identified products using Metasploit.
  As a result, it can examine real vulnerability of target web server.



Note
If you are interested, please use them in an environment under your control and at your own risk.

Installation

1. git clone GyoiThon's repository.

root@kali:~# git clone https://github.com/gyoisamurai/GyoiThon.git

2. Get python3-pip.

root@kali:~# apt-get update
root@kali:~# apt-get install python3-pip

3. install required python packages.

root@kali:~# cd GyoiThon
root@kali:~/GyoiThon# pip3 install -r requirements.txt
root@kali:~/GyoiThon# apt install python3-tk

4. Edit config.ini of GyoiThon.
   You have to edit your config.ini.
   More information is Usage.

usage:
    .\gyoithon.py [-s] [-m] [-g] [-e] [-c] [-p] [-l --log_path=<path>] [--no-update-vulndb]
    .\gyoithon.py [-d --category=<category> --vendor=<vendor> --package=<package>]
    .\gyoithon.py [-i]
    .\gyoithon.py -h | --help
options:
    -s   Optional : Examine cloud service.
    -m   Optional : Analyze HTTP response for identify product/version using Machine Learning.
    -g   Optional : Google Custom Search for identify product/version.
    -e   Optional : Explore default path of product.
    -c   Optional : Discover open ports and wrong ssl server certification using Censys.
    -p   Optional : Execute exploit module using Metasploit.
    -l   Optional : Analyze log based HTTP response for identify product/version.
    -d   Optional : Development of signature and train data.
    -i   Optional : Explore relevant FQDN with the target FQDN.
    -h --help     Show this help message and exit.

https gyoithon.example.com 443 /

https gyoithon.example.com 443 /
http 192.168.220.129 80 /vicnum/
https www.example.com 443 /catalog/

root@kali:~/GyoiThon# python3 gyoithon.py

Operation check environment

• Kali Linux 2018.2 (for Metasploit)
• CPU: Intel(R) Core(TM) i5-5200U 2.20GHz
• Memory: 8.0GB
• Metasploit Framework 4.16.48-dev
• Python 3.6.6