faze.cfg

# Default section is used to overwrite all other sections targets
[DEFAULT]
# I wouldn't mess with the main Phase-* dirs right now. Things depend on them.
directories = [
    "Phase-1",
    "Phase-2",
    "Reporting"
    ]

files = [
    "notes.md"
    ]

base_targets = targets
port_targets = port_targets.csv
tcp_port_results = Phase-2/tcp_port_results.md

[SERVICES]
logging = True
log_level = INFO
log_to_file = False
log_filename = faze.log

[SUBBRUTER]
# To disable any of the following programs, just leave their path blank
# eg. `gobuster_path =`
enabled = True
bruteforce_dns_enabled = True
add_discovered_domains = True
threads = 20
outdir = Phase-0/subbruter
gobuster_path = ~/go/bin/gobuster
reconng_path = /opt/recon-ng/recon-ng
sublister_path = /opt/Sublist3r/sublist3r.py
altdns_path = /opt/altdns/altdns.py
domain_wordlists =  [
    "/opt/SecLists/Discovery/DNS/sorted_knock_dnsrecon_fierce_recon-ng.txt"
    ]

[FPING]
enabled = True
path = fping

[NMAP]
# Only disable this if you have completed nmap xmls in Phase-1 (eg. to resume).
enabled = True
threads = 8
ports = T:1-65535,U:1-1024
# You can have multiple scan flags and it will run a new scan for each flag.
flags = [
    "-sV -sn",
    "-sV -O -sT -sU"
    ]
# Phase-2 scripts to run after targets/ports have been aquired.
# Disabled by default.
phase_2_enabled =
# outdir is for phase-2 only!
outdir = Phase-2/nmap
phase_2_scripts = [
    "vulscan/vulscan.nse",
    "vulscan/vulscan.nse vulscandb=scipvuldb.csv",
    "-A"
    ]

[HTTPSCREENSHOT]
enabled = True
outdir = Phase-2/httpscreenshot
path = httpscreenshot.py
workers = 10

[NIKTO]
# NOTE: if you enable this module, you'll probaby want to make sure your nikto
# config is set to UPDATES=no, otherwise if it detects a new(er) header, it'll
# just stall out.
enabled = True
outdir = Phase-2/nikto
path = nikto
filetype = xml

[DIRBRUTER]
enabled = True
outdir = Phase-2
user_agent = "Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101 Firefox/19.0"
wordlist_files = [
    "/opt/SecLists/Discovery/Web_Content/common.txt",
    "/opt/SecLists/Discovery/Web_Content/PHP.fuzz.txt",
    "/opt/SecLists/Discovery/Web_Content/Randomfiles.fuzz.txt"
    ]

[NESSUS]
enabled = True
scan_name = Faze Scan
url = https://localhost:8834
use_api = False
api_akey =
api_skey =
login = "username"
password = "password"
policy = Full - Intense
insecure = True
# This will lock each scan to 10 targets and append to the name.
is_home_license = True