erebus: fast tool for parameter-based vulnerability scanning

Erebus

Erebus is used to test every parameter across targets based on Yaml templates leading to zero false positives and providing fast scanning on a large number of hosts. Erebus offers many useful features including an intercepting proxy which allows researchers to browse the web, click on links and Erebus will test every parameter that passes through the proxy.

How templates work

Usage

Usage of erebus:
-burp-sitemap string
scan burp xml sitemap (without base64 decoded)
-c int
the number of concurrent requsts (default 100)
-crawl
crawl through each intercepted request
-depth int
the crawl depth (default 5)
-interceptor
intercept the requests through the proxy and test each parameter
-o string
output results to a file
-p string
the port on which the interception proxy will listen on (default “8080”)
-scope string
the scope for the proxy intercetor
-secure
determaines if the connection is secure or not
-silent
silent (only show vulnerable urls)
-t string
use the templates with all our yaml rules instead
-tc string
Use other tools by executing an os command (default “qsreplace”)
-ut
Install or update the erebus-templates

Example

Here are a few examples of how to use the Erebus scanner for part of your testing.

Intercept and Crawl on HTTP

Scanning for XSS vulnerabilities using the intercepting proxy with all of paypal inscope while crawling on HTTP domains.

Intercept and Crawl on HTTPS

Scanning for XSS vulnerabilities using the intercepting proxy with all of paypal inscope while crawling on HTTPS domains.

Tool Chaining Usage

Scanning for XSS vulnerabilities across a range of subdomains using subfinder and Gau

Scan subdomains from a file in the format https:// or http://

Install

Copyright (C) 2021 Blake