sarenka: obtaining and understanding Attack Surface

sarenka

SARENKA is an Open Source Intelligence (OSINT) tool which helps you obtaining and understanding Attack Surface.

The main goal is to gathering infromation from search engines for Internet-connected devices (https://censys.io/, https://www.shodan.io/). It scraps data about Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE) and also has a database where CVEs are mapped to CWE.

It returns data about the local machine – locally installed software (from Windows Registry), local network information (python libraries, popular cmd commands).

For now, the application has simple tools like hash calculator, Shannon entropy calculator, and very simple port scanner. More cryptography-math tools and reconnaissance scripts are planned.

Features

• gets data from https://censys.io/ by ip
• get data from https://www.shodan.io/ by ip
• get DNS data
• get WHOIS data
• banner grabbing
• find CVEs by CWE
• generate pdf report

You can also:

• calculate hashes based on user string
• calculate Shannon entropy based on user string
• check is port open|closed (instead always use nmap if you can – it’s slow)

Install & Use

Copyright (c) 2020 Dominika Pawlaczyk, Michał Pawlaczyk, Karolina Słonka