diff --git a/autorecon/default-plugins/hostname-discovery.py b/autorecon/default-plugins/hostname-discovery.py index e658506..f8366f1 100644 --- a/autorecon/default-plugins/hostname-discovery.py +++ b/autorecon/default-plugins/hostname-discovery.py @@ -7,33 +7,33 @@ urllib3.disable_warnings() class RedirectHostnameDiscovery(ServiceScan): - def __init__(self): - super().__init__() - self.name = 'Redirect Hostname Discovery' - self.slug = 'redirect-host-discovery' - self.tags = ['default', 'http', 'quick'] + def __init__(self): + super().__init__() + self.name = 'Redirect Hostname Discovery' + self.slug = 'redirect-host-discovery' + self.tags = ['default', 'http', 'quick'] - def configure(self): - self.match_service_name('^http') - self.match_service_name('^nacn_http$', negative_match=True) + def configure(self): + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) - async def run(self, service): - try: - url = f"{'https' if service.secure else 'http'}://{service.target.address}:{service.port}/" - resp = requests.get(url, verify=False, allow_redirects=False) + async def run(self, service): + try: + url = f"{'https' if service.secure else 'http'}://{service.target.address}:{service.port}/" + resp = requests.get(url, verify=False, allow_redirects=False) - if 'Location' in resp.headers: - location = resp.headers['Location'] - parsed = urlparse(location) - redirect_host = parsed.hostname + if 'Location' in resp.headers: + location = resp.headers['Location'] + parsed = urlparse(location) + redirect_host = parsed.hostname - if redirect_host: - service.info(f"[+] Redirect detected: {url} → {location}") - service.info(f"[+] Hostname found in redirect: {redirect_host}") - else: - service.info(f"[+] Redirect detected, but no hostname could be parsed: {location}") - else: - service.info(f"[-] No redirect detected at {url}") + if redirect_host: + service.info(f"[+] Redirect detected: {url} → {location}") + service.info(f"[+] Hostname found in redirect: {redirect_host}") + else: + service.info(f"[+] Redirect detected, but no hostname could be parsed: {location}") + else: + service.info(f"[-] No redirect detected at {url}") - except Exception as e: - service.error(f"[!] Error during redirect check on {service.target.address}:{service.port} — {e}") + except Exception as e: + service.error(f"[!] Error during redirect check on {service.target.address}:{service.port} — {e}") diff --git a/autorecon/default-plugins/virtual-host-enumeration.py b/autorecon/default-plugins/virtual-host-enumeration.py index 98e8788..e3942c7 100644 --- a/autorecon/default-plugins/virtual-host-enumeration.py +++ b/autorecon/default-plugins/virtual-host-enumeration.py @@ -6,48 +6,48 @@ urllib3.disable_warnings() class VirtualHost(ServiceScan): - def __init__(self): - super().__init__() - self.name = 'Virtual Host Enumeration' - self.slug = 'vhost-enum' - self.tags = ['default', 'safe', 'http', 'long'] + def __init__(self): + super().__init__() + self.name = 'Virtual Host Enumeration' + self.slug = 'vhost-enum' + self.tags = ['default', 'safe', 'http', 'long'] - def configure(self): - self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s') - self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s') - self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s') - self.match_service_name('^http') - self.match_service_name('^nacn_http$', negative_match=True) + def configure(self): + self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s') + self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s') + self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s') + self.match_service_name('^http') + self.match_service_name('^nacn_http$', negative_match=True) - async def run(self, service): - hostnames = [] - if self.get_option('hostname'): - hostnames.append(self.get_option('hostname')) - if service.target.type == 'hostname' and service.target.address not in hostnames: - hostnames.append(service.target.address) - if self.get_global('domain') and self.get_global('domain') not in hostnames: - hostnames.append(self.get_global('domain')) + async def run(self, service): + hostnames = [] + if self.get_option('hostname'): + hostnames.append(self.get_option('hostname')) + if service.target.type == 'hostname' and service.target.address not in hostnames: + hostnames.append(service.target.address) + if self.get_global('domain') and self.get_global('domain') not in hostnames: + hostnames.append(self.get_global('domain')) - if len(hostnames) > 0: - for wordlist in self.get_option('wordlist'): - name = os.path.splitext(os.path.basename(wordlist))[0] - for hostname in hostnames: - try: - wildcard = requests.get( - ('https' if service.secure else 'http') + '://' + service.target.address + ':' + str(service.port) + '/', - headers={'Host': ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + hostname}, - verify=False, - allow_redirects=False - ) - size = str(len(wildcard.content)) - except requests.exceptions.RequestException as e: - service.error(f"[!] Wildcard request failed for {hostname}: {e}") - continue + if len(hostnames) > 0: + for wordlist in self.get_option('wordlist'): + name = os.path.splitext(os.path.basename(wordlist))[0] + for hostname in hostnames: + try: + wildcard = requests.get( + ('https' if service.secure else 'http') + '://' + service.target.address + ':' + str(service.port) + '/', + headers={'Host': ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + hostname}, + verify=False, + allow_redirects=False + ) + size = str(len(wildcard.content)) + except requests.exceptions.RequestException as e: + service.error(f"[!] Wildcard request failed for {hostname}: {e}") + continue - await service.execute( - 'ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) + - ' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -mc all -fs ' + size + - ' -r -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"' - ) - else: - service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.') + await service.execute( + 'ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) + + ' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -mc all -fs ' + size + + ' -r -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"' + ) + else: + service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.')