Tentacle is a POC vulnerability verification and exploits framework. It supports the free extension of exploits and uses POC scripts. It supports calls to zoomeye, fofa, shodan, and other APIs to perform bulk vulnerability verification for multiple targets. (Still in DEV...)
pip3 install -r requestment.txt
When you run it for the first time, the configuration file
conf/tentacle.conf will be generated automatically.
# Show help for tentacle. python3 tentacle.py --help # Show all modual, and you can see it in `script` path. python3 tentacle.py --show # Show all function of module by -f show or -f help python3 tentacle.py -m script/web/web_status -f show python3 tentacle.py -m script/web/web_status -f help # Load target by iS/iN/iF/iT/iX/iE/gg/sd/ze/ff. # Scan port and then it will try to send the poc. python3 tentacle.py -m script/web/web_status -iS www.examples.com # Load target by url or host python3 tentacle.py -m script/web/web_status -iN 192.168.111.0/24 # Load target by network python3 tentacle.py -m script/web/web_status -iF target.txt # Load target by file python3 tentacle.py -m script/web/web_status -iT dcc54c3e1cc2c2e1 # Load target by recode's target python3 tentacle.py -m script/web/web_status -iX nmap_xml.xml # Load target by nmap.xml python3 tentacle.py -m script/web/web_status -iE "powered by discuz" # Load target by baidu/bing/360so python3 tentacle.py -m script/web/web_status -gg 'intext:powered by discuz' # Load target by google api python3 tentacle.py -m script/web/web_status -sd 'apache' # Load target by shodan api python3 tentacle.py -m script/web/web_status -ze 'app:weblogic' # Load target by zoomeye api python3 tentacle.py -m script/web/web_status -ff 'domain="example.com"' # Load target by fofa api # Load modual by -m (e.g. script/info/web_status,@web) python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status # Load web_status module python3 tentacle.py -iS 127.0.0.1 -m @web # Load all module of web path python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status,@web # Load all module of web path and web_status module python3 tentacle.py -iS 127.0.0.1 -m "*" # Load all module of script path # Set port scan scope python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status # Scan top 150 ports and then perform bulk vulnerability verification for multiple targets. python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status -sP # Skip port scan and then it will try the default port number server python3 tentacle.py -iS 127.0.0.1 -m script/web/web_status -lP 80-90,443 # Scan 80-90 ports and 443 port and then perform bulk vulnerability verification for multiple targets. # Use function of modual by -m and -f (e.g. -m web_status -f prove), and you should make sure the function of module is exist. python3 tentacle.py -m script/web/web_status -f prove # Show task's result by -tS python3 tentacle.py -tS 8d4b37597aaec25e # Export task's result by -tS to test.xlsx python3 tentacle.py -tS 8d4b37597aaec25e -o test # Update by git python3 tentacle.py --update
- [2018-11-15] Code refactoring and fix the bug.
- [2019-06-08] Code refactoring and add port scan.
- [2020-03-15] Code refactoring and add the script.
- Hakin9 is a monthly magazine dedicated to hacking and cybersecurity. In every edition, we try to focus on different approaches to show various techniques - defensive and offensive. This knowledge will help you understand how most popular attacks are performed and how to protect your data from them. Our tutorials, case studies and online courses will prepare you for the upcoming, potential threats in the cyber security world. We collaborate with many individuals and universities and public institutions, but also with companies such as Xento Systems, CATO Networks, EY, CIPHER Intelligence LAB, redBorder, TSG, and others.
- Blog2022.12.13What are the Common Security Weaknesses of Cloud Based Networks?
- Blog2022.10.12Vulnerability management with Wazuh open source XDR
- Blog2022.08.29Deception Technologies: Improving Incident Detection and Response by Alex Vakulov
- Blog2022.08.25Exploring the Heightened Importance of Cybersecurity in Mobile App Development by Jeff Kalwerisky
View all comments