RomanNum3ral
/
AutoRecon
mirror of https://github.com/Tib3rius/AutoRecon.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Changed spaces to tabs.

This commit is contained in:
Tib3rius 2025-05-27 13:41:19 -04:00
parent 1e54540a3f
commit 3a90dae058
2 changed files with 66 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
autorecon/default-plugins/hostname-discovery.py
View File

@ -7,33 +7,33 @@ urllib3.disable_warnings()
class RedirectHostnameDiscovery(ServiceScan): class RedirectHostnameDiscovery(ServiceScan):
def __init__(self): def __init__(self):
super().__init__() super().__init__()
self.name = 'Redirect Hostname Discovery' self.name = 'Redirect Hostname Discovery'
self.slug = 'redirect-host-discovery' self.slug = 'redirect-host-discovery'
self.tags = ['default', 'http', 'quick'] self.tags = ['default', 'http', 'quick']
def configure(self): def configure(self):
self.match_service_name('^http') self.match_service_name('^http')
self.match_service_name('^nacn_http$', negative_match=True) self.match_service_name('^nacn_http$', negative_match=True)
async def run(self, service): async def run(self, service):
try: try:
url = f"{'https' if service.secure else 'http'}://{service.target.address}:{service.port}/" url = f"{'https' if service.secure else 'http'}://{service.target.address}:{service.port}/"
resp = requests.get(url, verify=False, allow_redirects=False) resp = requests.get(url, verify=False, allow_redirects=False)
if 'Location' in resp.headers: if 'Location' in resp.headers:
location = resp.headers['Location'] location = resp.headers['Location']
parsed = urlparse(location) parsed = urlparse(location)
redirect_host = parsed.hostname redirect_host = parsed.hostname
if redirect_host: if redirect_host:
service.info(f"[+] Redirect detected: {url} → {location}") service.info(f"[+] Redirect detected: {url} → {location}")
service.info(f"[+] Hostname found in redirect: {redirect_host}") service.info(f"[+] Hostname found in redirect: {redirect_host}")
else: else:
service.info(f"[+] Redirect detected, but no hostname could be parsed: {location}") service.info(f"[+] Redirect detected, but no hostname could be parsed: {location}")
else: else:
service.info(f"[-] No redirect detected at {url}") service.info(f"[-] No redirect detected at {url}")
except Exception as e: except Exception as e:
service.error(f"[!] Error during redirect check on {service.target.address}:{service.port} — {e}") service.error(f"[!] Error during redirect check on {service.target.address}:{service.port} — {e}")

82
autorecon/default-plugins/virtual-host-enumeration.py
View File

@ -6,48 +6,48 @@ urllib3.disable_warnings()
class VirtualHost(ServiceScan): class VirtualHost(ServiceScan):
def __init__(self): def __init__(self):
super().__init__() super().__init__()
self.name = 'Virtual Host Enumeration' self.name = 'Virtual Host Enumeration'
self.slug = 'vhost-enum' self.slug = 'vhost-enum'
self.tags = ['default', 'safe', 'http', 'long'] self.tags = ['default', 'safe', 'http', 'long']
def configure(self): def configure(self):
self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s') self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s')
self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s') self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s')
self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s') self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s')
self.match_service_name('^http') self.match_service_name('^http')
self.match_service_name('^nacn_http$', negative_match=True) self.match_service_name('^nacn_http$', negative_match=True)
async def run(self, service): async def run(self, service):
hostnames = [] hostnames = []
if self.get_option('hostname'): if self.get_option('hostname'):
hostnames.append(self.get_option('hostname')) hostnames.append(self.get_option('hostname'))
if service.target.type == 'hostname' and service.target.address not in hostnames: if service.target.type == 'hostname' and service.target.address not in hostnames:
hostnames.append(service.target.address) hostnames.append(service.target.address)
if self.get_global('domain') and self.get_global('domain') not in hostnames: if self.get_global('domain') and self.get_global('domain') not in hostnames:
hostnames.append(self.get_global('domain')) hostnames.append(self.get_global('domain'))
if len(hostnames) > 0: if len(hostnames) > 0:
for wordlist in self.get_option('wordlist'): for wordlist in self.get_option('wordlist'):
name = os.path.splitext(os.path.basename(wordlist))[0] name = os.path.splitext(os.path.basename(wordlist))[0]
for hostname in hostnames: for hostname in hostnames:
try: try:
wildcard = requests.get( wildcard = requests.get(
('https' if service.secure else 'http') + '://' + service.target.address + ':' + str(service.port) + '/', ('https' if service.secure else 'http') + '://' + service.target.address + ':' + str(service.port) + '/',
headers={'Host': ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + hostname}, headers={'Host': ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + hostname},
verify=False, verify=False,
allow_redirects=False allow_redirects=False
) )
size = str(len(wildcard.content)) size = str(len(wildcard.content))
except requests.exceptions.RequestException as e: except requests.exceptions.RequestException as e:
service.error(f"[!] Wildcard request failed for {hostname}: {e}") service.error(f"[!] Wildcard request failed for {hostname}: {e}")
continue continue
await service.execute( await service.execute(
'ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) + 'ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) +
' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -mc all -fs ' + size + ' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -mc all -fs ' + size +
' -r -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"' ' -r -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"'
) )
else: else:
service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.') service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.')