Overview
Sniper is an automated exploitation tool that identifies and exploits known vulnerabilities in widely-deployed software. After a successful exploit, it automatically extracts artifacts (system information, users, network data) as evidence of compromise. Sniper is an exploitation tool: it actively attempts to exploit vulnerabilities to gain remote command execution. It does not add data to your Attack Surface or generate findings. Instead, it produces detailed reports with extracted artifacts as evidence.Supported targets
Attack modes
Unauthenticated mode
Sniper scans for open ports, fingerprints services, and attempts to exploit known vulnerabilities to gain access.Authenticated mode
Sniper uses provided credentials to establish a legitimate session and extracts artifacts without exploitation. Useful for post-authentication reconnaissance.Parameters
Port selection
See Port lists for the exact ports covered by each preset.
Scan options
CVE targeting
You can target specific CVEs (up to 10) to focus the scan on particular vulnerabilities. The CVEs must be part of Sniper’s exploit module database.Extractors
Choose which artifacts to extract after successful exploitation:How it works
Sniper executes a predefined attack workflow:1. Port scanning
Scans the specified TCP ports to identify open services. Results include port number, state, service name, and version.2. Web fingerprinting
For HTTP/HTTPS services, Sniper identifies the web application type (e.g., Outlook Web Access, VMware, Jenkins) and underlying technologies.3. Exploit matching
Based on the fingerprint data, Sniper filters its database to find compatible exploit modules.4. Vulnerability checking
Runs non-destructive checks to determine if the target is actually exploitable.5. Exploitation and extraction
If vulnerable, Sniper exploits the vulnerability to gain remote command execution, then runs extractors to collect artifacts.6. Cleanup
Removes any files or processes created during exploitation to leave the system unaltered.Exploit modules
Sniper includes custom exploit modules developed for critical vulnerabilities in widely-used software. These modules target:- Web servers and applications: Apache, IIS, Exchange, SharePoint, Confluence, etc.
- Network services: SSH, SMB, RDP, databases
- Known CVEs: Actively maintained database of exploitable vulnerabilities
Artifacts
Artifacts are data extracted from the target system after successful exploitation. They provide solid proof that the target is vulnerable and help with further manual testing.Follow-up actions
After successful exploitation:- Prioritize remediation: Exploitable vulnerabilities require immediate attention
- Expand testing: Use extracted network data for lateral movement assessment
- Run Network Scanner: Find additional infrastructure issues
- Document evidence: Use artifacts for penetration test reports