search

0xInfection / TIDoS-Framework

The Offensive Manual Web Application Penetration Testing Framework.
GNU General Public License v3.0
1.78k stars 392 forks source link
enumeration exploitation footprinting intelligence-gathering osint reconnaissance scanning-enumeration tidos-framework vulnerability-analysis vulnerability-detection web-application-security web-fuzzer web-penetration-testing

readme


TIDoS


The Offensive Web Application Penetration Testing Framework.

IMPORTANT:

The new Qt5 interface is complete, but has additional dependencies. Take a look at the updated installation instructions.

Highlights :-

Here is some light on what the framework is all about:

Main new features

Upcoming

Installation :-

Installation Script (Globally) :

To install the framework globally in /opt, run the provided core/install.py script as root. After this, you can launch TIDoS simply by typing tidos on the command line.

Manual Installation (Locally) :

TIDoS needs some libraries to run, which can be installed via aptitude or dnf Package Managers.

sudo apt-get install libncurses5 libxml2 nmap tcpdump libexiv2-dev build-essential python3-pip libmariadbclient18 libmysqlclient-dev tor konsole

Now after these dependencies are finished installing, we need to install the remaining Python Package dependencies, hence run:

pip3 install -r requirements.txt

TIDoS uses Vailyn to scan for path traversals in a new, improved path traversal module. If you want to use that module, head to https://github.com/VainlyStrain/Vailyn, and follow the installation instructions there.

Thats it. You now have TIDoS at your service. Fire it up using:

python3 tidv2               #Qt5 interface
sudo python3 tidconsole.py  #console interface

Docker image :

You can build it from Dockerfile :

git clone https://github.com/0xinfection/tidos-framework.git
cd tidos-framework/core/docker
docker build -t tidos .

To run TIDoS :

docker run --interactive --tty --rm tidos bash
tidos

Update: TIDoS is now available on Docker Hub. Install and run the container like this:

docker run -it vainlystrain/tidos-framework

Updating TIDoS :

To get the current version of TIDoS, move into the installation folder and perform (sudo) git pull #sudo if installed by install.py. Alternatively, you can run the fetch command in tidconsole.

Getting Started :-

To get started, you need to set your own API KEYS for various OSINT & Scanning and Enumeration purposes. To do so, open up API_KEYS.py under files/ directory and set your own keys and access tokens for SHODAN, CENSYS, FULL CONTACT, GOOGLE and WHATCMS.

GOOD NEWS:

The latest release of TIDoS includes all API KEYS and ACCESS TOKENS for SHODAN, CENSYS, FULL CONTACT, GOOGLE and WHATCMS by default. I found these tokens on various repositories on GitHub itself. You can now use all the modules which use the API KEYS. :)

Commands :-

__                                                    __                                                        
 !  attack    Attack specified target(s)              M
 :  clear     Clear terminal.                         :
 V  creds     Handle target credentials.              
 :  fetch     Check for and install updates.          :
 :  find      Search a module.                        :
    help      Show help message.                      :
    info      Show description of current module.     M
 :  intro     Display Intro.                          :
 :  leave     Leave module.                           M
    list      List all modules of a category.         :
 :  load      Load module.                            :
 :  netinfo   Show network information.               :
 :  opts      Show options of current module.         M
    phpsploit Load the phpsploit framework.           :
              (needs to be downloaded externally)
 :  processes Set number of processes in parallelis.  :
    q         Terminate TIDoS session.                :
 :  sessions  Interact with cached sessions.          :
 :  set       Set option value of module.             M
 :  tor       Pipe Attacks through the Tor Network.   :
    vicadd    Add Target to list.                     :
    vicdel    Delete Target from list.                :
    viclist   List all targets.                       :

  Avail. Cmds
    M needs loaded modvle
    V [! potentially] need loaded target(s)

Flawless Features :-

TIDoS presently supports the following: and more modules are under active development

Other Tools:

TIDoS In Action:

Lets see a demonstration of TIDoS in action:

asciicast

Version:

v2.0.1-5 [latest release] [#beta]

Disclaimer:

TIDoS is provided as an offensive web application audit framework. It has built-in modules which can reveal potential misconfigurations and vulnerabilties in web applications which could possibly be exploited maliciously.

THEREFORE, NEITHER THE AUTHOR NOR THE CONTRIBUTORS ARE RESPONSIBLE FOR ANY MISUSE OR DAMAGE DUE TO THIS TOOLKIT.