Lately I’ve been messing around with parrot and I ran into this awesome tool by the name of Golismero. When I first ran Golismero I was blown away at the awesomeness of this tool and now I’ve decided to create a cheet sheet for the tool itself.
Golismero
First is of course the help page, type:
sudo golismero -h
On your screen the help screen like this:
root@kali:~# golismero -h
/----------------------------------------------\
| GoLismero 2.0.0b3 - The Web Knife |
| Contact: golismero.project<@>gmail.com |
| |
| Daniel Garcia Garcia a.k.a cr0hn (@ggdaniel) |
| Mario Vilas (@Mario_Vilas) |
\----------------------------------------------/
usage: golismero.py COMMAND [TARGETS...] [--options]
SCAN:
Perform a vulnerability scan on the given targets. Optionally import
results from other tools and write a report. The arguments that follow may
be domain names, IP addresses or web pages.
PROFILES:
Show a list of available config profiles. This command takes no arguments.
PLUGINS:
Show a list of available plugins. This command takes no arguments.
INFO:
Show detailed information on a given plugin. The arguments that follow are
the plugin IDs. You can use glob-style wildcards.
REPORT:
Write a report from an earlier scan. This command takes no arguments.
To specify output files use the -o switch.
IMPORT:
Import results from other tools and optionally write a report, but don't
scan the targets. This command takes no arguments. To specify input files
use the -i switch.
DUMP:
Dump the database from an earlier scan in SQL format. This command takes no
arguments. To specify output files use the -o switch.
UPDATE:
Update GoLismero to the latest version. Requires Git to be installed and
available in the PATH. This command takes no arguments.
Ok so now we need to do a scan right? A “basic” scan would look something like this:
sudo golismero scan http://www.0x00sec.org
You could also output the results into a file like this:
sudo golismero scan http://www.0x00sec.org -o /root/scan.txt
Simple but upon enter this is where the interesting part begins. Golismero combines several different tools into one and runs them to find information about the target. Some tools that are run are SSLscan, Nmap’s Scripts, and my favorite, The Harvester.
Instead of having to run SSLscan like this:
sudo sslscan http://www.0x00sec.org:
Golismero runs sslscan with many different arguments founded in the help page.
Of course golismero has other tools like for example, the DNSbruteforce which as the name suggests brute forces the domains, but all the plugins built into golismero can be viewed with the command, plugins:
sudo golismero plugins
The last feature that I’m gonna show off is the import option. A simple example with a nikto file is a follows:
sudo golismero import nikto_scan.csv
The import options allows the importation of several different files to be imported into golismero.
Final words
For more examples of how to use golismero please check out this github site here. Other then that I hope that my quick and dirty introduction to golismero was effiecent enough for this type of post. If anyone wants a actual tutorial please comment down below.
Cheers.
