🔍 UltyScan

Attack Surface Management Platform

A comprehensive automated penetration testing and reconnaissance tool with a modern Web Interface for managing scans..

---

✨ Features

• 16 Scan Modes - From stealth reconnaissance to full aggressive audits
• Modern Web Interface - Launch and manage scans from your browser
• Automated Reporting - HTML reports generated for each scan
• Workspace Management - Organize results by project
• OSINT Integration - Shodan, Censys, Hunter.io, and more
• Vulnerability Scanning - Nuclei, Nikto, and custom checks
• Bruteforce Capabilities - Password attacks on discovered services

---

🚀 Quick Start

One-Command Installation

git clone https://github.com/DeNNiiInc/UltyScan /usr/share/sniper
cd /usr/share/sniper
bash install.sh force

Note: The force flag runs the installation without prompts for fully automated deployment.

After Installation

The installer will display your Web Interface URL:

============================================
  ULTYSCAN WEB INTERFACE
============================================
  URL: http://<YOUR_IP>/ultyscan/
  Logs: /var/log/ultyscan/
  Loot: /usr/share/sniper/loot/workspace/
============================================

---

🖥️ Web Interface

Accessing the UI

Open your browser and navigate to:

http://<SERVER_IP>/ultyscan/

Security Warning ⚠️

Caution

THIS UTILITY RUNS WITH ROOT PRIVILEGES.

1. DO NOT expose the Web Interface directly to the public internet.
2. DO NOT run this on a server running other critical services.
3. ALWAYS use a VPN or SSH Tunnel (e.g. ssh -L 8888:localhost:8888 user@server) to access the interface.
4. The default install creates a www-data sudoer entry allowing execution of critical commands.

Features

Tab	Description
New Scan	Configure and launch scans with all modes and options
Workspaces	View, export, and delete scan workspaces
Console	Live output from running scans
Settings	Update scanner and stop running scans

Scan Configuration Options

Option	Description
Target	Domain name or IP address to scan
Scan Mode	Select from 16 different scan modes
Workspace	Name to organize your results
Enable OSINT	Gather intelligence from public sources
Enable Recon	Subdomain and DNS enumeration
Enable Bruteforce	Password attacks on services
Full Port Scan	Scan all 65535 ports

---

📋 Scan Modes

Mode	Description	Use Case
normal	Balanced scan with enumeration	General purpose
stealth	Low-profile, minimal traffic	Avoiding detection
web	Ports 80/443 only	Web application focus
webscan	Full web application audit	Deep web analysis
webporthttp	HTTP on custom port	Non-standard web ports
webporthttps	HTTPS on custom port	Non-standard SSL ports
port	Single specific port	Targeted service testing
fullportonly	All 65535 ports	Complete port discovery
discover	Network/CIDR scanning	Infrastructure mapping
flyover	Quick multi-target	Fast initial assessment
airstrike	Fast enumeration	Speed over depth
nuke	Full aggressive audit	Maximum coverage
massportscan	Multi-target port scan	Bulk port scanning
massweb	Multi-target web scan	Multiple web targets
masswebscan	Multi-target webapp	Bulk web app testing
massvulnscan	Multi-target vulns	Bulk vulnerability scan

---

⌨️ Command Line Usage

Basic Scan

sniper -t example.com

With Options

sniper -t example.com -m normal -w myproject -o -re

Full Scan with All Features

sniper -t example.com -m normal -w myproject -o -re -b -fp

Command Line Options

Flag	Description
-t <target>	Target domain or IP
-f <file>	File with list of targets
-m <mode>	Scan mode
-w <name>	Workspace name
-o	Enable OSINT
-re	Enable Recon
-b	Enable Bruteforce
-fp	Full port scan
-p <port>	Specific port number

Workspace Management

# List all workspaces
sniper --list

# Delete a workspace
sniper -w myproject -d

# Export workspace
sniper -w myproject --export

---

📁 Directory Structure

Path	Description
/usr/share/sniper/	Installation directory
/usr/share/sniper/loot/workspace/	Scan results and reports
/var/www/html/ultyscan/	Web interface files
/var/log/ultyscan/	Web UI scan logs
/root/.sniper.conf	Main configuration file

---

⚙️ Configuration

API Keys

Edit /root/.sniper.conf to add your API keys:

# Shodan API Key
SHODAN_API_KEY="your_key_here"

# Censys API
CENSYS_APP_ID="your_id"
CENSYS_API_SECRET="your_secret"

# Hunter.io
HUNTERIO_KEY="your_key"

# GitHub (for secret scanning)
GITHUB_API_KEY="your_token"

Enabling/Disabling Features

In /root/.sniper.conf:

# Enable/Disable scanners (1=on, 0=off)
NUCLEI="1"
NIKTO="0"
WPSCAN="1"
SHODAN="1"

---

🔒 Security Notes

⚠️ Important Security Considerations

1. Network Access: The Web UI should only be accessible from trusted networks
2. Root Privileges: The scanner requires root to perform its functions
3. Legal Authorization: Only scan systems you have permission to test

---

🐳 Docker Installation

cd /usr/share/sniper
docker-compose up -d
docker exec -it kali-linux bash
./install.sh force

---

📊 Viewing Reports

Via Web Interface

1. Go to the Workspaces tab
2. Click View on any workspace
3. Report opens in new tab

Direct Path

/usr/share/sniper/loot/workspace/<NAME>/sniper-report.html

Via Web Server

http://<SERVER_IP>/loot/workspace/<NAME>/sniper-report.html

---

🔧 Troubleshooting

Scan Not Starting

# Check if sniper is installed correctly
which sniper

# Test manually
sniper -t example.com

Web UI Shows "Idle" When Scan Running

# Check if process is running
ps aux | grep sniper

# Check sudoers
cat /etc/sudoers.d/www-data-sniper

Permission Denied

# Reinstall sudoers configuration
echo 'www-data ALL=(ALL) NOPASSWD: /usr/bin/bash /usr/share/sniper/sniper *' > /etc/sudoers.d/www-data-sniper
chmod 440 /etc/sudoers.d/www-data-sniper

---

📝 License

See LICENSE.md for details.

---

🤝 Contributing

Contributions are welcome! Please submit pull requests to improve the tool.