Migrate vhost and subdomain enumeration to ffuf with async subprocess

autorecon/default-plugins/subdomain-enumeration.py

@@ -1,8 +1,12 @@
 from autorecon.plugins import ServiceScan
-import os
+import asyncio
+import requests
+import urllib3
+import os, random, string
+
+urllib3.disable_warnings()
 
 class SubdomainEnumeration(ServiceScan):
-
     def __init__(self):
         super().__init__()
         self.name = "Subdomain Enumeration"
@@ -17,7 +21,6 @@ class SubdomainEnumeration(ServiceScan):
 
     async def run(self, service):
         domains = []
-
         if self.get_option('domain'):
             domains.append(self.get_option('domain'))
         if service.target.type == 'hostname' and service.target.address not in domains:
@@ -25,10 +28,77 @@ class SubdomainEnumeration(ServiceScan):
         if self.get_global('domain') and self.get_global('domain') not in domains:
             domains.append(self.get_global('domain'))
 
-		if len(domains) > 0:
+        if not domains:
+            service.info('The target was not a domain, nor was a domain provided as an option. Skipping subdomain enumeration.')
+            return
+
+        scheme   = 'https' if service.secure else 'http'
+        ip_url   = f"{scheme}://{service.target.address}:{service.port}/"
+        scandir  = os.path.join(service.target.scandir, f"{service.protocol}{service.port}")
+        protocol = service.protocol
+        port     = service.port
+
         for wordlist in self.get_option('wordlist'):
             name = os.path.splitext(os.path.basename(wordlist))[0]
+
             for domain in domains:
-					await service.execute('gobuster dns -d ' + domain + ' -r {addressv6} -w ' + wordlist + ' -o "{scandir}/{protocol}_{port}_' + domain + '_subdomains_' + name + '.txt"')
+                # Wildcard probe — get baseline status and size
-		else:
+                wildcard_status = None
-			service.info('The target was not a domain, nor was a domain provided as an option. Skipping subdomain enumeration.')
+                wildcard_sizes  = []
+
+                for i in range(3):
+                    fuzz_host = ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + domain
+                    try:
+                        resp = await asyncio.to_thread(
+                            requests.get,
+                            ip_url,
+                            headers={'Host': fuzz_host, 'User-Agent': 'Vhost Finder'},
+                            verify=False,
+                            allow_redirects=False,
+                            timeout=10,
+                        )
+                        wildcard_status = resp.status_code
+                        wildcard_sizes.append(len(resp.content))
+                    except requests.exceptions.RequestException:
+                        pass
+
+                filter_sizes = list(set(wildcard_sizes))
+                filter_codes = [str(wildcard_status)] if wildcard_status else []
+
+                if not filter_codes and not filter_sizes:
+                    service.info(f'Could not establish wildcard baseline for {domain}. Skipping.')
+                    continue
+
+                outfile = os.path.join(scandir, f"{protocol}_{port}_{domain}_subdomains_{name}.txt")
+
+                cmd = [
+                    'ffuf',
+                    '-u', ip_url,
+                    '-H', f'Host: FUZZ.{domain}',
+                    '-H', 'User-Agent: Vhost Finder',
+                    '-w', wordlist,
+                    '-t', str(self.get_option('threads')),
+                    '-mc', 'all',
+                    '-noninteractive',
+                    '-s',
+                ]
+
+                if filter_codes:
+                    cmd += ['-fc', ','.join(filter_codes)]
+                if filter_sizes:
+                    cmd += ['-fs', ','.join(str(s) for s in filter_sizes)]
+
+                proc = await asyncio.create_subprocess_exec(
+                    *cmd,
+                    stdout=asyncio.subprocess.PIPE,
+                    stderr=asyncio.subprocess.DEVNULL,
+                )
+
+                with open(outfile, 'w') as f:
+                    async for line in proc.stdout:
+                        hit = line.decode(errors='replace').strip()
+                        if hit and '#' not in hit:
+                            f.write(hit + '\n')
+                            f.flush()
+
+                await proc.wait()

autorecon/default-plugins/virtual-host-enumeration.py

@@ -1,11 +1,12 @@
 from autorecon.plugins import ServiceScan
-from shutil import which
+import asyncio
-import os, requests, random, string, urllib3
+import requests
+import urllib3
+import os, random, string
 
 urllib3.disable_warnings()
 
 class VirtualHost(ServiceScan):
-
     def __init__(self):
         super().__init__()
         self.name = 'Virtual Host Enumeration'
@@ -28,26 +29,77 @@ class VirtualHost(ServiceScan):
         if self.get_global('domain') and self.get_global('domain') not in hostnames:
             hostnames.append(self.get_global('domain'))
 
-		if len(hostnames) > 0:
+        if not hostnames:
+            service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.')
+            return
+
+        scheme   = 'https' if service.secure else 'http'
+        ip_url   = f"{scheme}://{service.target.address}:{service.port}/"
+        scandir  = os.path.join(service.target.scandir, f"{service.protocol}{service.port}")
+        protocol = service.protocol
+        port     = service.port
+
         for wordlist in self.get_option('wordlist'):
             name = os.path.splitext(os.path.basename(wordlist))[0]
+
             for hostname in hostnames:
+                # Wildcard probe — get baseline status and size
+                wildcard_status = None
+                wildcard_sizes  = []
+
+                for i in range(3):
+                    fuzz_host = ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + hostname
                     try:
-						wildcard = requests.get(
+                        resp = await asyncio.to_thread(
-							('https' if service.secure else 'http') + '://' + service.target.address + ':' + str(service.port) + '/',
+                            requests.get,
-							headers={'Host': ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + hostname},
+                            ip_url,
+                            headers={'Host': fuzz_host, 'User-Agent': 'Vhost Finder'},
                             verify=False,
-							allow_redirects=False
+                            allow_redirects=False,
+                            timeout=10,
                         )
-						size = str(len(wildcard.content))
+                        wildcard_status = resp.status_code
-					except requests.exceptions.RequestException as e:
+                        wildcard_sizes.append(len(resp.content))
-						service.error(f"[!] Wildcard request failed for {hostname}: {e}")
+                    except requests.exceptions.RequestException:
+                        pass
+
+                filter_sizes = list(set(wildcard_sizes))
+                filter_codes = [str(wildcard_status)] if wildcard_status else []
+
+                if not filter_codes and not filter_sizes:
+                    service.info(f'Could not establish wildcard baseline for {hostname}. Skipping.')
                     continue
 
-					await service.execute(
+                outfile = os.path.join(scandir, f"{protocol}_{port}_{scheme}_{hostname}_vhosts_{name}.txt")
-						'ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) +
+
-						' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -mc all -fs ' + size +
+                cmd = [
-						' -r -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"'
+                    'ffuf',
+                    '-u', ip_url,
+                    '-H', f'Host: FUZZ.{hostname}',
+                    '-H', 'User-Agent: Vhost Finder',
+                    '-w', wordlist,
+                    '-t', str(self.get_option('threads')),
+                    '-mc', 'all',
+                    '-noninteractive',
+                    '-s',
+                ]
+
+                if filter_codes:
+                    cmd += ['-fc', ','.join(filter_codes)]
+                if filter_sizes:
+                    cmd += ['-fs', ','.join(str(s) for s in filter_sizes)]
+
+                proc = await asyncio.create_subprocess_exec(
+                    *cmd,
+                    stdout=asyncio.subprocess.PIPE,
+                    stderr=asyncio.subprocess.DEVNULL,
                 )
-		else:
+
-			service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.')
+                with open(outfile, 'w') as f:
+                    async for line in proc.stdout:
+                        hit = line.decode(errors='replace').strip()
+                        if hit and '#' not in hit:
+                            f.write(hit + '\n')
+                            f.flush()
+
+                await proc.wait()