mirror of
https://github.com/j3ssie/osmedeus.git
synced 2026-08-26 17:42:27 +02:00
j3ssie
1403d20a4d
- Add LLM executor supporting OpenAI vision, tool calling, embeddings, and structured outputs - Introduce event emitter/receiver workflows with deduplication and filtering (generate_event functions) - Add workflow extends/override system enabling inheritance chains and step merge modes - Update function naming to snake_case across all testdata (fileExists→file_exists, etc.) - Add comprehensive test fixtures for linter, events, CDN, step dependencies, and extends workflows
103 lines
3.4 KiB
YAML
103 lines
3.4 KiB
YAML
name: subdomain-enumeration
|
|
kind: module
|
|
desc: Comprehensive subdomain enumeration workflow demonstrating various step types
|
|
|
|
params:
|
|
- name: threads
|
|
value: "10"
|
|
- name: resolvers
|
|
value: "{{Data}}/resolvers.txt"
|
|
- name: wordlist
|
|
value: "{{Data}}/subdomains-top1million-5000.txt"
|
|
|
|
steps:
|
|
# Step 1: bash - Initialize output directories
|
|
- name: setup-directories
|
|
type: bash
|
|
commands:
|
|
- mkdir -p {{Output}}/subdomains
|
|
- mkdir -p {{Output}}/resolved
|
|
- mkdir -p {{Output}}/wordlists
|
|
exports:
|
|
subdomain_dir: "{{Output}}/subdomains"
|
|
resolved_dir: "{{Output}}/resolved"
|
|
|
|
# Step 2: function - Log start and validate target
|
|
- name: validate-target
|
|
type: function
|
|
script: |
|
|
log_info("Starting subdomain enumeration for: {{Target}}");
|
|
if (is_empty("{{Target}}")) {
|
|
log_error("Target is empty");
|
|
return false;
|
|
}
|
|
return true;
|
|
|
|
# Step 3: parallel-steps - Run multiple passive enumeration tools concurrently
|
|
- name: passive-enumeration
|
|
type: parallel-steps
|
|
parallel_steps:
|
|
- name: subfinder-scan
|
|
type: bash
|
|
command: "{{Binaries}}/subfinder -d {{Target}} -silent -o {{subdomain_dir}}/subfinder.txt"
|
|
timeout: 600
|
|
- name: amass-passive
|
|
type: bash
|
|
command: "{{Binaries}}/amass enum -passive -d {{Target}} -o {{subdomain_dir}}/amass.txt"
|
|
timeout: 900
|
|
- name: assetfinder-scan
|
|
type: bash
|
|
command: "{{Binaries}}/assetfinder --subs-only {{Target}} > {{subdomain_dir}}/assetfinder.txt"
|
|
timeout: 300
|
|
|
|
# Step 4: bash - Merge and deduplicate results
|
|
- name: merge-results
|
|
type: bash
|
|
command: "cat {{subdomain_dir}}/*.txt | sort -u > {{subdomain_dir}}/all-subdomains.txt"
|
|
exports:
|
|
all_subdomains: "{{subdomain_dir}}/all-subdomains.txt"
|
|
|
|
# Step 5: function - Check if we found any subdomains
|
|
- name: check-results
|
|
type: function
|
|
script: |
|
|
var count = file_length("{{all_subdomains}}");
|
|
log_info("Found " + count + " unique subdomains");
|
|
if (count == 0) {
|
|
log_warn("No subdomains found, trying bruteforce");
|
|
}
|
|
return count;
|
|
exports:
|
|
subdomain_count: "{{Result}}"
|
|
|
|
# Step 6: bash with pre_condition - Active bruteforce if passive found few results
|
|
- name: active-bruteforce
|
|
type: bash
|
|
pre_condition: "file_length('{{all_subdomains}}') < 50"
|
|
command: "{{Binaries}}/puredns bruteforce {{wordlist}} {{Target}} -r {{resolvers}} -w {{subdomain_dir}}/bruteforce.txt"
|
|
timeout: 1800
|
|
on_error: continue
|
|
|
|
# Step 7: foreach - Resolve each subdomain for live hosts
|
|
- name: resolve-subdomains
|
|
type: foreach
|
|
input: "{{all_subdomains}}"
|
|
variable: subdomain
|
|
threads: "{{threads}}"
|
|
step:
|
|
name: resolve-single
|
|
type: bash
|
|
command: "echo [[subdomain]] | {{Binaries}}/dnsx -silent -a -resp -o {{resolved_dir}}/[[subdomain]].txt"
|
|
timeout: 30
|
|
on_error: continue
|
|
|
|
# Step 8: bash with parallel_commands - Final aggregation
|
|
- name: final-aggregation
|
|
type: bash
|
|
parallel_commands:
|
|
- "cat {{resolved_dir}}/*.txt 2>/dev/null | grep -v '^$' | sort -u > {{Output}}/resolved-subdomains.txt"
|
|
- "wc -l {{subdomain_dir}}/all-subdomains.txt | awk '{print $1}' > {{Output}}/stats.txt"
|
|
- "echo 'Enumeration completed at:' $(date) >> {{Output}}/stats.txt"
|
|
exports:
|
|
final_subdomains: "{{Output}}/resolved-subdomains.txt"
|