yellow

~ opinionated web scanning pipeline for pentesters in a hurry
git clone https://github.com/djnnvx/yellow.git
README.md (7615B)
      1 ~ yellow
      2 
      3 ```
      4         ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣤⣤⣤⣤⣤⣤⣄⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
      5     ⠀              ⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⠛⠻⠿⢿⣿⣿⣿⣿⣿⣶⣤⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
      6    Y E L L O W ⠀⠀⠀⢀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⣿⣿⣿⣿⣿⣿⣶⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀
      7         ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣷⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⠀
      8       --------  ⠀⠀⢸⣿⣿⣿⣿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⣀⣀⣀⣀⣙⢿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀
      9         ⠀⠀⠀⠀  ⠀⠀⠀⠀⠀⢿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⣶⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠻⣿⣿⣿⣿⣿⣿⣿⣄⠀⠀⠀⠀
     10         djnn.sh⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀⢹⣿⣿⣿⣿⣿⣿⣿⣆⠀⠀⠀
     11         ⠀v0.0.8  ⠀⠀⢠⣿⣿⣿⣿⡟⠹⠿⠟⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡏⠀⠀⠀⠀⢿⣿⣿⣿⣿⣿⣿⣿⡆⠀⠀
     12         ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡿⠋⡬⢿⣿⣷⣤⣤⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠀⠀⠀⠀⠀⠸⣿⣿⣿⣿⣿⣿⣿⣿⡀⠀
     13         ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠰⡇⢸⡇⢸⣿⣿⣿⠟⠁⢀⣬⢽⣿⣿⣿⣿⣿⣿⠋⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣧⠀
     14         ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣧⣈⣛⣿⣿⣿⡇⠀⠀⣾⠁⢀⢻⣿⣿⣿⣿⠇⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⡀
     15         ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⣿⣿⣿⣿⣿⣿⣧⣄⣀⠙⠷⢋⣼⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
     16         ⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇
     17         ⣿⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠁
     18         ⣿⣿⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠀
     19         ⠸⣿⣿⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠀⠀⢀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠃⠀
     20         ⠀⢹⣿⣿⣧⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣄⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀
     21         ⠀⠀⠹⣿⣿⣿⣷⣄⠀⠀⠀⠀⠀⠀⠀⠀⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⠀
     22         ⠀⠀⠀⠙⣿⣿⣿⣿⣿⣶⣤⣀⠀⠀⠀⠀⣿⣿⣿⣿⣿⣿s/o jenaye :)~⣿⣿⣿⣿⣿⣿⠋⠀⠀⠀⠀
     23         ⠀⠀⠀⠀⠈⠻⣿⣿⣿⣿⣿⣿⣿⣷⣶⣶⣾⣿⣿⣿⣿⣿⣿⣿⣿matro7sh⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀
     24         ⠀⠀⠀⠀⠀⠀⠉⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀⠀⠀⠀
     25         ⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠋⠅⠀⠀⠀⠀⠀⠀⠀⠀⠀
     26         ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠿⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠈⠂⠀⠀⠀
     27         ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠉⠛⠛⠛⠛⠛⠛⠛⠋⠉⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
     28 
     29     <=[ Pentest companion for scanning, OSINT, and quick wins ]=>
     30 ```
     31 
     32 **yellow** is a tiny golang CLI to quickly set up scanning at the beginning of a pentest. :)~
     33 
     34 Based on yelaa: https://github.com/matro7sh/Yelaa.
     35 
     36 ## Disclaimer
     37 
     38 This software is provided as-is, at the discretion of professionals.
     39 Developpers assume no responsability for your lack of morals or overall stupidity.
     40 Please use at your own risk, in a controlled environnement. Thanks<3
     41 
     42 ## Installing
     43 
     44 Using go v1.27.
     45 
     46 ```bash
     47 git clone https://evil.djnn.sh/yellow.git
     48 cd yellow/
     49 make          # or: make docker
     50 ```
     51 
     52 The docker image ships chromium. On the host, katana and httpx download their own
     53 (~150MB) on first run if no chrome is installed.
     54 
     55 ## Running
     56 
     57 Every tool is a `core.Module` (see `core/module.go`), wired in as a library rather
     58 than shelled out. Run any subcommand with `--help` for its flags.
     59 
     60 ### Directory tree
     61 
     62 ```bash
     63 ./yellow -d djnn.sh
     64 ```
     65 
     66 Creates `extracted/{assets,code,creds}`, `scans/{infra,nessus,screenshots,ssl}` and
     67 `www/{exploits,tools}` under `djnn.sh/`.
     68 
     69 ### Passive enumeration
     70 
     71 ```bash
     72 ./yellow osint -d djnn.sh
     73 ```
     74 
     75 subfinder, assetfinder, dnsx, gau, alterx, dorks, leaker, shodan. Discovered assets
     76 land in `scans/domains.txt`. Each IP is also mapped to its ASN and BGP prefix
     77 (`asn.json`) over DNS via Team Cymru, with Shadowserver as a fallback.
     78 
     79 That ASN data is informational and never feeds back into scanning. For a cloud-hosted
     80 target the prefix belongs to the provider and can span millions of unrelated addresses,
     81 so those are flagged `hosting_provider: true`. Treat it as a scope boundary, not a
     82 target list.
     83 
     84 ### Prune dead hosts
     85 
     86 osint returns historical domains, plenty of which are gone. Filter to the live ones:
     87 
     88 ```bash
     89 ./yellow prune -f djnn.sh/scans/domains.txt -o djnn.sh/scans/web-targets.txt
     90 ```
     91 
     92 ### Active scans
     93 
     94 ```bash
     95 ./yellow scan -d djnn.sh/scans/infra --file djnn.sh/scans/web-targets.txt
     96 ```
     97 
     98 Default pipeline: sitemap, robots.txt, katana crawl, secret scan, tlsx, wappalyzergo,
     99 cvemap, httpx. Opt in to more:
    100 
    101 ```bash
    102 ./yellow scan -d djnn.sh --port-scan          # TCP + service fingerprinting
    103 ./yellow scan -d djnn.sh --gobuster           # dir bruteforce, rooted at crawled dirs
    104 ./yellow scan -d djnn.sh --nuclei             # downloads ~hundreds of MB of templates
    105 ```
    106 
    107 Disable the slow defaults with `--no-katana` and `--no-secrets`.
    108 
    109 Katana drives a real browser, so it picks up endpoints that only appear once JavaScript
    110 has run. Its URLs feed the secret scan, gobuster and nuclei, bounded by
    111 `--katana-max-urls`.
    112 
    113 The secret scan re-fetches each crawled URL and runs the `gitleaks` rule set over it,
    114 writing `secrets.json`. **That file holds raw secret values.** gitleaks is tuned for
    115 source repos, so minified JS throws high-entropy false positives: treat findings as
    116 leads. Rule ID and entropy are recorded so noisy rules are easy to spot.
    117 
    118 Port scanning checks every resolved IP against `cdncheck` first. Hosts behind a WAF are
    119 annotated in `portscan.json` and skipped, since you would only be scanning the reverse
    120 proxy. CDN and cloud ranges are annotated but still scanned, because cdncheck files
    121 ordinary cloud compute under `cdn`, and skipping that would drop real origins.
    122 
    123 ### Fingerprint only
    124 
    125 Wappalyzer plus CVE lookup, without the rest of the scan:
    126 
    127 ```bash
    128 ./yellow fingerprint -d djnn.sh/scans/infra --file djnn.sh/scans/web-targets.txt
    129 ```
    130 
    131 ## Environment
    132 
    133 All optional. Modules self-skip when their key is absent.
    134 
    135 | variable | unlocks |
    136 |---|---|
    137 | `NVD_API_KEY` | faster CVE lookups ([free key](https://nvd.nist.gov/developers/request-an-api-key)); without one NVD allows 5 requests per 30s and yellow sleeps 7s between queries |
    138 | `SHODAN_API_KEY` | the shodan module |
    139 | `LEAKER_PROVIDER_CONFIG` | path to a leaker provider config, e.g. `~/.config/leaker/provider-config.yml` containing `leakcheck: [your-key]` |
    140 | `HTTP_PROXY` | set for you by `-p/--proxy` |
    141 
    142 ## Contributing
    143 
    144 This software's code is public, but not open to contributions. If something is
    145 integrated, I want to be sure I can maintain it afterwards.
    146 
    147 Ideas are welcome though: https://djnn.sh/pgp