diff --git a/autorecon/default-plugins/hostname-discovery.py b/autorecon/default-plugins/hostname-discovery.py new file mode 100644 index 0000000..e658506 --- /dev/null +++ b/autorecon/default-plugins/hostname-discovery.py @@ -0,0 +1,39 @@ +from autorecon.plugins import ServiceScan +import requests +from urllib.parse import urlparse +import urllib3 + +urllib3.disable_warnings() + +class RedirectHostnameDiscovery(ServiceScan): + + def __init__(self): + super().__init__() + self.name = 'Redirect Hostname Discovery' + self.slug = 'redirect-host-discovery' + self.tags = ['default', 'http', 'quick'] + + def configure(self): + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) + + async def run(self, service): + try: + url = f"{'https' if service.secure else 'http'}://{service.target.address}:{service.port}/" + resp = requests.get(url, verify=False, allow_redirects=False) + + if 'Location' in resp.headers: + location = resp.headers['Location'] + parsed = urlparse(location) + redirect_host = parsed.hostname + + if redirect_host: + service.info(f"[+] Redirect detected: {url} → {location}") + service.info(f"[+] Hostname found in redirect: {redirect_host}") + else: + service.info(f"[+] Redirect detected, but no hostname could be parsed: {location}") + else: + service.info(f"[-] No redirect detected at {url}") + + except Exception as e: + service.error(f"[!] Error during redirect check on {service.target.address}:{service.port} — {e}") diff --git a/autorecon/default-plugins/virtual-host-enumeration.py b/autorecon/default-plugins/virtual-host-enumeration.py index 6689de3..98e8788 100644 --- a/autorecon/default-plugins/virtual-host-enumeration.py +++ b/autorecon/default-plugins/virtual-host-enumeration.py @@ -1,39 +1,53 @@ from autorecon.plugins import ServiceScan from shutil import which import os, requests, random, string, urllib3 + urllib3.disable_warnings() class VirtualHost(ServiceScan): - def __init__(self): - super().__init__() - self.name = 'Virtual Host Enumeration' - self.slug = 'vhost-enum' - self.tags = ['default', 'safe', 'http', 'long'] + def __init__(self): + super().__init__() + self.name = 'Virtual Host Enumeration' + self.slug = 'vhost-enum' + self.tags = ['default', 'safe', 'http', 'long'] - def configure(self): - self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s') - self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s') - self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s') - self.match_service_name('^http') - self.match_service_name('^nacn_http$', negative_match=True) + def configure(self): + self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s') + self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s') + self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s') + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) - async def run(self, service): - hostnames = [] - if self.get_option('hostname'): - hostnames.append(self.get_option('hostname')) - if service.target.type == 'hostname' and service.target.address not in hostnames: - hostnames.append(service.target.address) - if self.get_global('domain') and self.get_global('domain') not in hostnames: - hostnames.append(self.get_global('domain')) + async def run(self, service): + hostnames = [] + if self.get_option('hostname'): + hostnames.append(self.get_option('hostname')) + if service.target.type == 'hostname' and service.target.address not in hostnames: + hostnames.append(service.target.address) + if self.get_global('domain') and self.get_global('domain') not in hostnames: + hostnames.append(self.get_global('domain')) - if len(hostnames) > 0: - for wordlist in self.get_option('wordlist'): - name = os.path.splitext(os.path.basename(wordlist))[0] - for hostname in hostnames: - wildcard = requests.get(('https' if service.secure else 'http') + '://' + service.target.address + ':' + str(service.port) + '/', headers={'Host':''.join(random.choice(string.ascii_letters) for i in range(20)) + '.' + hostname}, verify=False) + if len(hostnames) > 0: + for wordlist in self.get_option('wordlist'): + name = os.path.splitext(os.path.basename(wordlist))[0] + for hostname in hostnames: + try: + wildcard = requests.get( + ('https' if service.secure else 'http') + '://' + service.target.address + ':' + str(service.port) + '/', + headers={'Host': ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + hostname}, + verify=False, + allow_redirects=False + ) + size = str(len(wildcard.content)) + except requests.exceptions.RequestException as e: + service.error(f"[!] Wildcard request failed for {hostname}: {e}") + continue - size = str(len(wildcard.content)) - await service.execute('ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) + ' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -mc all -fs ' + size + ' -r -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"') - else: - service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.') + await service.execute( + 'ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) + + ' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -mc all -fs ' + size + + ' -r -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"' + ) + else: + service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.')