nmap_automated_discovery.sh

#!/bin/bash

#Check Root Priv

if [[ "$EUID" = 0 ]]; then
   echo "(1) PASSED: Root Privleges Check "
else
   echo "Root privileges required for thorough scan."
    sudo -su # make sure to ask for password on next sudo
    if sudo true; then
        echo "(2) correct password"
    else
        echo "(3) wrong password"
        exit 1
    fi
fi


#Define Subnet

while true
do
	read -r -p "Enter IP [EXAMPLE: 10.1.1.0]: " IP
	read -r -p "Enter Subnet in CIDR format without the / [EXAMPLE: 24]: " SUBNET
		scanrange="${IP}/${SUBNET}"
		scanname="${IP}_${SUBNET}"
		discoveredhosts="${scanname}_discoveredhosts"
	echo "Your scan range is $scanrange "
	read -r -p "Is this correct? [Y/n] " input

 case $input in
     [yY][eE][sS]|[yY])
 echo "Splendid. Your scanfiles will start with $scanname"
 break
 ;;
     [nN][oO]|[nN])
 echo "No? Let's try this again..."
        ;;
     *)
 echo "Invalid input..."
 ;;
 esac
done

#Discovery Scan Options

mainmenu() {
    echo -ne "
MAIN MENU - Select your scan type
1) Sneaky - Sneak past IDS/IPS
2) Fast - Speedy but not so thorough or quite
3) Thorough - Good balance between speed and comprehensive. Noisy.
4) Comprehensive - Slow, Noisy but most comprehensive.
0) Exit
Choose an option:  "
    read -r ans
    case $ans in
    1)
    echo "Running Sneaky Discovery Scan... Sneaking by IPS/IDS"
    nmap -sS -P0 -T sneaky -f -v -oA $discoveredhosts $scanrange
    echo "Discovery Scan complete. Scan output files begin with $discoveredhosts "
    exit 1
        ;;
    2)
    echo "Running Fast (Noisy) Discovery Scan..."
    nmap -T5 -PS21-25,53,88,80,110,135,139,389,443,445,1099,3306,3389,4786,5432,8000,8080,8443,9443 -v -oA $discoveredhosts $scanrange
    echo "Discovery Scan complete. Scan output files begin with $discoveredhosts "
    exit 2
        ;;
    3)
    echo "Running Thorough (Noisy) Discovery Scan..."
    nmap -sS -sU -T5 -A -v -oA $discoveredhosts $scanrange
    echo "Discovery Scan complete. Scan output files begin with $discoveredhosts "
    exit 3
        ;;
    4)
    echo "Running Slow, (Noisy) Comprehensive Discovery Scan..."
    nmap -sS -sU -T4 -A -v -PE -PP -PS80,443 -PA3389 -PU40125 -PY -g 53 --script "default or (discovery and safe)" -oA $discoveredhosts $scanrange
    echo "Discovery Scan complete. Scan output files begin with $discoveredhosts "
     exit 4
        ;;

    0)
        echo "Bye bye."
        exit 0
        ;;
    *)
        echo "Wrong option."
        exit 1
        ;;
    esac
}

mainmenu

#Create HTML Report of the NMAP XML Output

xsltproc ${discoveredhosts}.xml -o ${discoveredhosts}.html

#Create list of live IPs

awk '/is up/ {print up}; {gsub (/\(|\)/,""); up = $NF}' ${discoveredhosts}.xml > ${scanname}_liveIPaddresses.txt


#Create lists of IP based on Service
### More can be added be appending additional services and repeating the code block below
###1099 (Java RMI), 4786 (Cisco Smart Install), 5432 (PostgreSQL)

service="netbios-ssn"
xmlstarlet sel -t -m "//port[@protocol='tcp' and service/@name=$service and state/@state='open']/ancestor::host/address[@addrtype='ipv4']" -v '@addr' -n ${discoveredhosts}.xml > ${scanname}_${service}_open_ip.txt
 echo "${service}_open_ip.txt Generated "

service="microsoft-ds"
xmlstarlet sel -t -m "//port[@protocol='tcp' and service/@name=$service and state/@state='open']/ancestor::host/address[@addrtype='ipv4']" -v '@addr' -n ${discoveredhosts}.xml > ${scanname}_${service}_open_ip.txt
 echo "${service}_open_ip.txt Generated "

service="telnet"
xmlstarlet sel -t -m "//port[@protocol='tcp' and service/@name=$service and state/@state='open']/ancestor::host/address[@addrtype='ipv4']" -v '@addr' -n ${discoveredhosts}.xml > ${scanname}_${service}_open_ip.txt
 echo "${service}_open_ip.txt Generated "

service="ssh"
xmlstarlet sel -t -m "//port[@protocol='tcp' and service/@name=$service and state/@state='open']/ancestor::host/address[@addrtype='ipv4']" -v '@addr' -n ${discoveredhosts}.xml > ${scanname}_${service}_open_ip.txt
 echo "${service}_open_ip.txt Generated "

service="ftp"
xmlstarlet sel -t -m "//port[@protocol='tcp' and service/@name=$service and state/@state='open']/ancestor::host/address[@addrtype='ipv4']" -v '@addr' -n ${discoveredhosts}.xml > ${scanname}_${service}_open_ip.txt
 echo "${service}_open_ip.txt Generated "

service="http"
xmlstarlet sel -t -m "//port[@protocol='tcp' and service/@name=$service and state/@state='open']/ancestor::host/address[@addrtype='ipv4']" -v '@addr' -n ${discoveredhosts}.xml > ${scanname}_${service}_open_ip.txt
 echo "${service}_open_ip.txt Generated "

service="https"
xmlstarlet sel -t -m "//port[@protocol='tcp' and service/@name=$service and state/@state='open']/ancestor::host/address[@addrtype='ipv4']" -v '@addr' -n ${discoveredhosts}.xml > ${scanname}_${service}_open_ip.txt
 echo "${service}_open_ip.txt Generated "

 echo "FIN"