scriptkiddi3 v0.1.4 releases: recon and initial vulnerability detection tool

by do son · Published January 30, 2023 · Updated September 8, 2023

SCRIPTKIDDI3

Introducing SCRIPTKIDDI3, a powerful recon and initial vulnerability detection tool for Bug Bounty Hunters. Built using a variety of open-source tools and a shell script, SCRIPTKIDDI3 allows you to quickly and efficiently run a scan on the target domain and identify potential vulnerabilities.

SCRIPTKIDDI3 begins by performing recon on the target system, collecting information such as subdomains, and running services with nuclei. It then uses this information to scan for known vulnerabilities and potential attack vectors, alerting you to any high-risk issues that may need to be addressed.

In addition, SCRIPTKIDDI3 also includes features for identifying misconfigurations and insecure default settings with nuclei templates, helping you ensure that your systems are properly configured and secure.

SCRIPTKIDDI3 is an essential tool for conducting thorough and effective recon and vulnerability assessments. Let’s Find Bugs with SCRIPTKIDDI3.

How does it work?

This tool mainly performs 3 tasks

Effective Subdomain Enumeration from Various Tools
Get URLs with open HTTP and HTTPS service.
Run a Nuclei and other scans on previous output So basically, this is an automation script for your initial recon in bugbounty

MODES

1. FULL EXPLOITATION MODE

Run SCRIPTKIDDI3 in FULL EXPLOITATION MODE

  scriptkiddi3 -m EXP -d target.com

FULL EXPLOITATION MODE contains the following functions

Effective Subdomain Enumeration with different services and open-source tools
Effective URL Enumeration ( HTTP and HTTPs service )
Run Vulnerability Detection with Nuclei
Subdomain Takeover Test on previous results

2. SUBDOMAIN ENUMERATION MODE

Run scriptkiddi3 in SUBDOMAIN ENUMERATION MODE

  scriptkiddi3 -m SUB -d target.com

SUBDOMAIN ENUMERATION MODE contains the following functions

Effective Subdomain Enumeration with different services and open-source tools
You can use this mode if you only want to get subdomains from this tool or we can say Automation of Subdomain Enumeration by different tools

3. URL ENUMERATION MODE

Run scriptkiddi3 in URL ENUMERATION MODE

  scriptkiddi3 -m URL -d target.com

URL ENUMERATION MODE contains the following functions

Same Feature as SUBDOMAIN ENUMERATION MODE but also identifies HTTP or HTTPS service

Using your own CONFIG File for subfinder

  scriptkiddi3 -m EXP -d target.com -c /path/to/config.yaml

You can also provide your own CONDIF file with your API Keys for subdomain enumeration with subfinder

Updating the tool to the latest version You can run the following command to update the tool

  scriptkiddi3 -u

An Example of config.yaml

binaryedge:

  - 0bf8919b-aab9-42e4-9574-d3b639324597

  - ac244e2f-b635-4581-878a-33f4e79a2c13

censys:

  - ac244e2f-b635-4581-878a-33f4e79a2c13:dd510d6e-1b6e-4655-83f6-f347b363def9

certspotter: []

passivetotal:

  - sample-email@user.com:sample_password

securitytrails: []

shodan:

  - AAAAClP1bJJSRMEYJazgwhJKrggRwKA

github:

  - ghp_lkyJGU3jv1xmwk4SDXavrLDJ4dl2pSJMzj4X

  - ghp_gkUuhkIYdQPj13ifH4KA3cXRn8JD2lqir2d4

zoomeye:

  - zoomeye_username:zoomeye_password

Changelog v0.1.4

What’s New

Webhook Integration

With our new webhook integration, you can stay informed about the activities and processes running through ScriptKiddi3 in real-time.
Get instant updates on your preferred messaging platforms like Discord, Microsoft Teams, Telegram, and many others, making it easier than ever to monitor and manage your processes.
Receive alerts, notifications, and important information directly from ScriptKiddi3 without needing to check the tool manually.