bash-oneliners

Pentest automation oneliners for reconnaissance, enumeration and exploitation.

Quick Start

# Subdomain enumeration
./oneliners.sh recon --subdomains target.com

# XSS testing
./oneliners.sh exploit --xss urls.txt

# Full recon pipeline
./oneliners.sh recon --passive target.com -o ./output

Run with custom options:

./oneliners.sh exploit --sqli params.txt -t 100 -o ./results

Commands

Recon (4)

Command	Description
--whois <file>	Web technology fingerprinting via webtech
--subdomains <domain>	Full subdomain enum (subfinder + shuffledns + dnsx + httpx + katana)
--juicy <domain>	Filter subdomains containing api/dev/test/admin/staging/vpn
--passive <domain>	Passive recon via APIs (crt.sh, certspotter, archive.org, hackertarget, alienvault)

Enum (4)

Command	Description
--urls <file>	Collect all URLs (waybackurls + gau + katana)
--dirs <file>	Directory bruteforce with dirsearch
--js <file>	JavaScript analysis and secret extraction (mantra, jsleak)
--params <file>	Extract URLs with = parameters for injection testing

Exploit (7)

Command	Description
--nuclei <file>	Vulnerability scanning (critical/high/medium severity)
--xss <file>	XSS testing with dalfox + airixss validation
--sqli <file>	SQL injection (sqlmap + ghauri with WAF bypass)
--lfi <file>	LFI testing with path traversal payloads
--cors <file>	CORS misconfiguration detection
--redirect <file>	Open redirect testing
--bypass403 <file>	403/401 bypass techniques

Options

Flag	Description	Default
-t, --threads	Concurrent threads	50
-o, --output	Output directory	./output
-T, --timeout	Request timeout	10s
-r, --resolvers	DNS resolvers file	-
-w, --wordlist	Custom wordlist	-

Examples

# Passive subdomain gathering
./oneliners.sh recon --passive target.com

# Find juicy subdomains (api, dev, admin, etc.)
./oneliners.sh recon --juicy target.com

# Collect all URLs from subdomain list
./oneliners.sh enum --urls subs.txt

# Extract JS files and scan for secrets
./oneliners.sh enum --js subs.txt

# SQLi testing with high thread count
./oneliners.sh exploit --sqli params.txt -t 100

# LFI testing
./oneliners.sh exploit --lfi urls.txt

# CORS misconfiguration
./oneliners.sh exploit --cors alive.txt

# 403 bypass on admin endpoints
./oneliners.sh exploit --bypass403 subs.txt

Pipeline Example

# Full recon -> enum -> exploit pipeline
./oneliners.sh recon --subdomains target.com -o ./target && \
./oneliners.sh enum --urls ./target/alive.txt && \
./oneliners.sh enum --params ./target/allurls.txt && \
./oneliners.sh exploit --xss ./target/params.txt && \
./oneliners.sh exploit --sqli ./target/sqli_candidates.txt

Dependencies

• projectdiscovery: subfinder, dnsx, httpx, katana, nuclei
• tomnomnom: waybackurls, anew, qsreplace
• hahwul/dalfox
• sqlmapproject/sqlmap
• ffuf/ffuf
• lc/gau
• maurosoria/dirsearch

Features

• Colored terminal output with progress indicators
• Automatic dependency checking
• Chained tool pipelines
• Output deduplication via anew
• WAF evasion techniques in SQLi/XSS modules
• Multi-source passive recon (7+ APIs)