0x00 Arsenal

Front-end/back-end separated project: https://github.com/godzeo/ArsenalWeb

This project is a red team arsenal platform that includes commonly used red team capabilities and also integrates other useful tools.

Still under development…

It is not fully open source for now because there are still many bugs and the code quality is somewhat poor…

Development

Front-end/back-end separated project:

Back end: Django + Django REST Framework

Front end: Vue + Element UI

JWT authentication with Swagger support

Required Environment

Redis + npm + Python 3.7

0x02 Components (Features)

• Sharing of the latest red team vulnerabilities (in Markdown format)
• Enterprise information collection (rudimentary front-end interface; data source: Qichacha)
• Vulnerability scanning for individual websites
• Vulnerability scanning (large-scale asset vulnerability scanning)
• Other system features

TODO

• A data-cleaning component is missing

Large-scale asset vulnerability scanning workflow:

• Root domain collection (the enterprise information collection module can be used)

• Subdomain collection

• Passive information collection (FOFA, Shodan)

• IP address resolution

• Port and fingerprint scanning (web top 20)

• Web service detection

• WAF detection

• Fingerprint identification for important applications (fingerprint identification module)

• Custom POC scanning (intended to support the recently discovered Goby POC format—not yet completed)

• Vulnerability scanning engine (third-party engines only)

​

Note: Bugs must be minimized throughout the process; otherwise, the number of tasks will grow exponentially.

0x03 Completed Features

Login

Main Menu

Enterprise Information Collection Module

Excel data:

Vulnerability Sharing

Vulnerability Scanning—Root Domain Module

Vulnerability Scanning—Subdomain Module

All Vulnerability Information

Other