Discover
Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Ubuntu. Limited support for Kali Linux.
- Lee Baird @discoverscripts
- Jay "L1ghtn1ng" Townsend @jay_townsend1
Setup and usage
- Download to your home directory.
cd ~
git clone https://github.com/leebaird/discover
cd discover/
./discover.sh
- On first run, Discover asks for your first name (max 10 letters) and saves it to
~/.discover/operator-name. That name is written on every engagement audit log line. To change it later, edit or delete that file and restart Discover.
- Select main menu option 18 Update to update the operating system and install dependencies.
- Some options require root credentials to run.
Optional shell helpers (config/zshrc)
cd ~/discover/config/
./install.sh
| Host | What install.sh does |
|---|
| Ubuntu / other (incl. macOS) | Copies zshrc to ~/.bash_aliases and sources it |
Kali (detected via /etc/os-release) | Appends zshrc to ~/.zshrc |
Also installs tmux.conf to ~/.tmux.conf and vimrc to ~/.vimrc.
Useful commands (after install / new shell):
| Command | Purpose |
|---|
n | Network summary (external/internal IP, DNS, MAC, iface; ss without TIME-WAIT; ping 8.8.8.8) |
s | cd ~/discover and short git status (no pull) |
m / ms | Start MSF DB + console / stop MSF DB |
web / web2 | HTTP server on port 80 (sudo) / 8000 |
now | Formatted date/time (does not override date) |
update | Grok update + full apt upgrade chain |
bh, th, smb, sip | BloodHound, theHarvester, smbserver, IP sort |
Network identity (IPs, DNS, MAC) is computed when you run n / web / upload — not at shell startup — so new shells stay fast and values stay current after VPN/wifi changes.
Notes
- On Ubuntu and other non-Kali hosts, re-running overwrites
~/.bash_aliases with the repo copy.
- On Kali, re-running
install.sh appends again and can duplicate the block; edit ~/.zshrc or install only once.
- Default zsh on macOS/Kali does not load
~/.bash_aliases unless you source it from ~/.zshrc.
Main menu
RECON
1. Domain
2. Person
SCANNING
3. Generate target list
4. CIDR
5. List
6. IP, range, or URL
7. Rerun Nmap scripts and MSF aux
WEB
8. Insecure direct object reference
9. Open multiple tabs in Firefox
10. Nikto
11. SSL
MISC
12. Generate a malicious payload
13. Start a Metasploit listener
14. CVE lookup
15. Parse XML
16. Dev
17. Notes
18. Update
19. Exit
RECON
Domain
RECON
1. Passive
2. Breaches
3. Find registered domains
4. Google dorks
5. Web search
6. Active
7. Open report
8. Previous menu
Note: Passive and Active cannot be run as root.
Engagement workflow
- Passive — build
$HOME/data/<domain>/ HTML report.
- Open report (or finish Active) so the engagement is on statusd.
- Audit > Import — names, names/titles/emails, subdomains, or another operator’s package into the current report.
- Active — httpx / whatweb / gowitness; Active and Subdomains pages; optional NVD CVSS.
- Shodan (optional) — Active page Enrich (Shodan checkbox).
- Alerts (optional) — Active page, left of Enrich. Check now watches Software versions.
- Software filter on Active, then filtered Subdomains, then host scans in operator mode.
- Export — on Report > Audit (Discover-hosted only): Client, Defender, or Operator package.
Passive recon
Uses Amass, ARIN, DNSRecon, dnstwist, Metasploit, subfinder, Shodan CTL (free CT hostnames; no API key), theHarvester, Whois, and multiple websites.
- Acquire free API keys for maximum results with theHarvester (
$HOME/.theHarvester/api-keys.yaml).
- Passive builds an HTML report at
$HOME/data/<domain>/.
- Find registered domains updates
pages/registered-domains.htm in an existing report. A domain with no registration email is left off the page.
- HTML Reports menu: Passive, Active, and Audit.
- Names: US public companies pull DEF 14A / Form 4 from SEC EDGAR.
- Summary: HQ from 10-K then website footer (
tools/company-manual.tsv override); social profile links when found.
Import
On Reports > Audit, Import (Discover-hosted only) targets the current engagement.
| Choice | What it does |
|---|
| Operator scans | Merge another operator’s unpacked report (host-scans, screenshots, Active data, their audit lines) |
| Names | Merge tools/names-manual.tsv (Name, Title, Phone; # comments; filled title/phone win) |
| Names, titles, and emails | Merge an external names dump into Names and Emails |
| Subdomains | Existing sources (Firefox / Pentest-Tools / TSV) or CSV subdomain,ip,category; optional Active on new public hosts |
CLI (same backends):
bash recon/import-names.sh --report /home/user/data/example.com --json
bash recon/import-names-titles-emails.sh --report /home/user/data/example.com --source /path/to/dump --json
bash recon/import-subdomains.sh --report /home/user/data/example.com \
--mode team-csv --import /home/user/team-hosts.csv --json
# existing: --mode existing --import firefox|/path/to/export
# optional CSV: --run-active
This is the beginning of the README. Read the rest at the original. Read the full README ↗
