Around two months back, my good friend and fellow compatriot of the OSCP program Erik (@Maleus21) had an excellent idea - come up with a way to automate multiple manual tasks in order to trim some time off of the enumeration process during the OSCP exam. It was also a chance for him to learn Python. Fast forward a week and he had a working solution. It did the job it was supposed to and he learned a lot along the way! I used it during my exam and while I was working through the exam, I decided that I wanted to build on the excellent work Erik had already done with enumerator. I had big plans, and after the stress of the exam passed, I decided to fork enumerator and put those plans into action.
The task of automating the information discovery phase of a pentest is typically one of the first things a pentester with drive and desire will work to create. In fact, there are plenty of such scripts floating around to freely use! The issue present in many of these solutions are that they are very much tied to a specific configuration and are not easily portable to other environments, let alone other platforms. To a seasoned pentester or developer, this is a non-issue; it's trivial to work around these setbacks. However, that still takes time, and sometimes time is a luxury not always alloted us. My goals for enumerator were:
- Make it fast.
- Make it portable/easily distributable.
- Make it dead simple to use without inspecting/modifying code.
- Make it easy to extend.
It took a few evenings to rewrite enumerator to accomplish all of these goals, but seeing the end result in action made it all worth it. Last night I published enumerator on PyPi (https://pypi.python.org/pypi/enumerator), and is up to almost 300 installs in less than 24 hours! Also, the process of installing and using this application couldn't be much easier, in my opinion! Of course, the work is not over, and there are so many more ideas I have to make enumerator even better! In the works are some more robust performance tweaks, more configurable options, useable runtime output and even report generation and some cool application integrations to just name a few!
All of this wouldn't have been possible without a solid starting point from my buddy Erik; he has some awesome ideas and has been putting his time to good use doing all sorts of cool stuff over at http://overflowsecurity.com. enumeraor is publicly available on my GitHub (https://github.com/stevecoward/Enumerator), so if you find any bugs or can think of any features that would be beneficial, please feel free to either drop me a line or post it on the enumerator repository on GitHub!