reNgine v2.0.2 releases: an automated reconnaissance framework

reNgine

reNgine is an automated reconnaissance framework with a focus on a highly configurable streamlined recon process. reNgine is backed by a database, with data correlation and organization, the custom query “like” language for recon data filtering, reNgine aims to address the shortcomings of traditional recon workflow. Developers behind the reNgine understand that recon data can be huge, manually looking up for entries to attack could be cumbersome, with features like Auto Interesting Subdomains discovery, reNgine automatically identifies interesting subdomains to attack based on certain keywords (both built-in and custom) and helps penetration testers focus on attack rather than recon.

reNgine is also focused on continuous monitoring. Penetration testers can choose to schedule the scan at periodic intervals, get notified on notification channels like Discord, Slack, and Telegram for any new subdomains or vulnerabilities identified, or any recon data changes.

Interoperability is something every recon tool needs, and reNgine is no different. Beginning reNgine 1.0, we additionally developed features such as import and export subdomains, endpoints, GF pattern matched endpoints, etc. This will allow you to use your favourite recon workflow in conjunction with reNgine.

reNgine features Highly configurable scan engines based on YAML, that allows penetration testers to create as many recon engines as they want of their choice, configure as they wish, and use it against any targets for the scan. These engines allow penetration testers to use tools of their choice, the configuration of their choice. Out of the box, reNgine comes with several scan engines like Full Scan, Passive Scan, Screenshot gathering, OSINT Engine, etc.

Our focus has always been on finding the right recon data with very minimal effort. While having a discussion with fellow hackers/pentesters, screenshots gallery was a must, reNgine 1.0 also comes with a screenshot gallery, and what’s exciting than having a screenshot gallery with filters, filter screenshots with HTTP status, technology, ports, and services.

Feature

• Reconnaissance:
  • Subdomain Discovery
  • IP and Open Ports Identification
  • Endpoints Discovery
  • Directory/Files fuzzing
  • Screenshot Gathering
  • Vulnerability Scan
    • Nuclei
    • Dalfox XSS Scanner
    • CRLFuzzer
    • Misconfigured S3 Scanner
  • WHOIS Identification
  • WAF Detection
• OSINT Capabilities
  • Meta info Gathering
  • Employees Gathering
  • Email Address gathering
  • Google Dorking for sensitive info and urls
• Projects, create distinct project spaces, each tailored to a specific purpose, such as personal bug bounty hunting, client engagements, or any other specialized recon task.
• Perform Advanced Query lookup using natural language alike and, or, not operations
• Highly configurable YAML-based Scan Engines
• Support for Parallel Scans
• Support for Subscans
• Recon Data visualization
• GPT Vulnerability Description, Impact and Remediation generation
• GPT Attack Surface Generator
• Multiple Roles and Permissions to cater a team’s need
• Customizable Alerts/Notifications on Slack, Discord, and Telegram
• Automatically report Vulnerabilities to HackerOne
• Recon Notes and Todos
• Clocked Scans (Run reconnaissance exactly at X Hours and Y minutes) and Periodic Scans (Runs reconnaissance every X minutes/- hours/days/week)
• Proxy Support
• Screenshot Gallery with Filters
• Powerful recon data filtering with autosuggestions
• Recon Data changes, find new/removed subdomains/endpoints
• Tag targets into the Organization
• Smart Duplicate endpoint removal based on page title and content length to cleanup the reconnaissance data
• Identify Interesting Subdomains
• Custom GF patterns and custom Nuclei Templates
• Edit tool-related configuration files (Nuclei, Subfinder, Naabu, amass)
• Add external tools from Github/Go
• Interoperable with other tools, Import/Export Subdomains/Endpoints
• Import Targets via IP and/or CIDRs
• Report Generation
• Toolbox: Comes bundled with most commonly used tools during penetration testing such as whois lookup, CMS detector, CVE lookup, etc.
• Identification of related domains and related TLDs for targets
• Find actionable insights such as Most Common Vulnerability, Most Common CVE ID, Most Vulnerable Target/Subdomain, etc.

Screenshots

Scan results

Gathered Endpoints

Of course, at this point, reNgine does not give the best of the best result compared to other tools, but it has certainly minimal efforts. Also, I am continuously adding new features. You may help me on this journey by creating a PR filled with new features and bug fixes. Please have a look at the Contributing section before doing so.

Flow

Changelog v2.0.2

• Added tooltip text to dashboard total vulnerabilities tooltip by @luizmlo in #1029
• ops(uninstall.sh): add missing volumes and echo messages by @AnonymousWP in #977
• Fix no results in target subdomain list by @psyray in #1036
• Fix Tool Settings Broken Link by @aqhmal in #1021
• Fix subdomains list empty in Target by @psyray in #1053
• Raise page limit to 500 for popup list by @psyray in #1051
• Add directories count on Directories list by @psyray in #1050
• ops(docker-compose): upgrade to 2.23.0 by @AnonymousWP in #1023
• Fix endpoints list and count by @psyray in #1041
• Fix failing visualization when dorks are present by @psyray in #1045
• Fix note not saving by @psyray in #1047
• Count only not done todos in subdomains list by @psyray in #1048
• Fix user agent definition keyword by @psyray in #1054
• Upgrade project discovery tool at CT build by @psyray in #1055
• Add a check to not load datatables twice by @psyray in #1039
• Nmap port scan fails when Naabu return no port by @psyray in #1067
• chore(issue-templates): incorrect label name by @AnonymousWP in #1066
• Endpoints list popup empty by @psyray in #1070
• Add missing domain id value in subscan by @psyray in #1069
• Fixes for #1033, #1026, #1027 by @yogeshojha in #1071
• Temporary fix to prevent celery beat crash by @psyray in #1072
• fix: ffuf ANSI code processing preventing task to finish by @ocervell in #1058
• Update views.py by @Vijayragha1 in #1074
• Fix crash on saving endpoint (FFUF related only) by @psyray in #1063
• chore(issue-templates): fix incorrect description by @AnonymousWP in #1078
• IOError -> OSError by @jxdv in #1081
• Add directories count on Directories list by @psyray in #1090
• chore(issue-template): don’t allow blank issues by @AnonymousWP in #1089
• Fix bad nuclei config name by @psyray in #1098
• disallow empty password by @yogeshojha in #1105
• fix attribute error on scan history #1103 by @yogeshojha in #1104
• issue-633: added already-in-org filter to target dropdown in org form by @SeanOverton in #1106
• Update Dockerfile to fix silicon incompatability by @SubGlitch1 in #1107
• Add source for nmap scan by @psyray in #1108
• Spelling mistake in hackerone.html by @Linuxinet in #1112
• fix(version): incorrect number in art by @AnonymousWP in #1111
• Fix report generation when Ignore Informational Vulnerabilities checked by @psyray in #1100
• fix(tool_arsenal): incorrect regex version numbers by @AnonymousWP in #1086

Install & Use

Copyright (C) 2020 yogeshojha