Migrate vhost and subdomain enumeration to ffuf with async subprocess
This commit is contained in:
root
parent
e7e98f60bd
commit
cef27b1518
|
|
@ -1,34 +1,104 @@
|
||||||
from autorecon.plugins import ServiceScan
|
from autorecon.plugins import ServiceScan
|
||||||
import os
|
import asyncio
|
||||||
|
import requests
|
||||||
|
import urllib3
|
||||||
|
import os, random, string
|
||||||
|
|
||||||
|
urllib3.disable_warnings()
|
||||||
|
|
||||||
class SubdomainEnumeration(ServiceScan):
|
class SubdomainEnumeration(ServiceScan):
|
||||||
|
def __init__(self):
|
||||||
|
super().__init__()
|
||||||
|
self.name = "Subdomain Enumeration"
|
||||||
|
self.slug = "subdomain-enum"
|
||||||
|
self.tags = ['default', 'safe', 'long', 'dns']
|
||||||
|
|
||||||
def __init__(self):
|
def configure(self):
|
||||||
super().__init__()
|
self.add_option('domain', help='The domain to use as the base domain (e.g. example.com) for subdomain enumeration. Default: %(default)s')
|
||||||
self.name = "Subdomain Enumeration"
|
self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating subdomains. Separate multiple wordlists with spaces. Default: %(default)s')
|
||||||
self.slug = "subdomain-enum"
|
self.add_option('threads', default=10, help='The number of threads to use when enumerating subdomains. Default: %(default)s')
|
||||||
self.tags = ['default', 'safe', 'long', 'dns']
|
self.match_service_name('^domain')
|
||||||
|
|
||||||
def configure(self):
|
async def run(self, service):
|
||||||
self.add_option('domain', help='The domain to use as the base domain (e.g. example.com) for subdomain enumeration. Default: %(default)s')
|
domains = []
|
||||||
self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating subdomains. Separate multiple wordlists with spaces. Default: %(default)s')
|
if self.get_option('domain'):
|
||||||
self.add_option('threads', default=10, help='The number of threads to use when enumerating subdomains. Default: %(default)s')
|
domains.append(self.get_option('domain'))
|
||||||
self.match_service_name('^domain')
|
if service.target.type == 'hostname' and service.target.address not in domains:
|
||||||
|
domains.append(service.target.address)
|
||||||
|
if self.get_global('domain') and self.get_global('domain') not in domains:
|
||||||
|
domains.append(self.get_global('domain'))
|
||||||
|
|
||||||
async def run(self, service):
|
if not domains:
|
||||||
domains = []
|
service.info('The target was not a domain, nor was a domain provided as an option. Skipping subdomain enumeration.')
|
||||||
|
return
|
||||||
|
|
||||||
if self.get_option('domain'):
|
scheme = 'https' if service.secure else 'http'
|
||||||
domains.append(self.get_option('domain'))
|
ip_url = f"{scheme}://{service.target.address}:{service.port}/"
|
||||||
if service.target.type == 'hostname' and service.target.address not in domains:
|
scandir = os.path.join(service.target.scandir, f"{service.protocol}{service.port}")
|
||||||
domains.append(service.target.address)
|
protocol = service.protocol
|
||||||
if self.get_global('domain') and self.get_global('domain') not in domains:
|
port = service.port
|
||||||
domains.append(self.get_global('domain'))
|
|
||||||
|
|
||||||
if len(domains) > 0:
|
for wordlist in self.get_option('wordlist'):
|
||||||
for wordlist in self.get_option('wordlist'):
|
name = os.path.splitext(os.path.basename(wordlist))[0]
|
||||||
name = os.path.splitext(os.path.basename(wordlist))[0]
|
|
||||||
for domain in domains:
|
for domain in domains:
|
||||||
await service.execute('gobuster dns -d ' + domain + ' -r {addressv6} -w ' + wordlist + ' -o "{scandir}/{protocol}_{port}_' + domain + '_subdomains_' + name + '.txt"')
|
# Wildcard probe — get baseline status and size
|
||||||
else:
|
wildcard_status = None
|
||||||
service.info('The target was not a domain, nor was a domain provided as an option. Skipping subdomain enumeration.')
|
wildcard_sizes = []
|
||||||
|
|
||||||
|
for i in range(3):
|
||||||
|
fuzz_host = ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + domain
|
||||||
|
try:
|
||||||
|
resp = await asyncio.to_thread(
|
||||||
|
requests.get,
|
||||||
|
ip_url,
|
||||||
|
headers={'Host': fuzz_host, 'User-Agent': 'Vhost Finder'},
|
||||||
|
verify=False,
|
||||||
|
allow_redirects=False,
|
||||||
|
timeout=10,
|
||||||
|
)
|
||||||
|
wildcard_status = resp.status_code
|
||||||
|
wildcard_sizes.append(len(resp.content))
|
||||||
|
except requests.exceptions.RequestException:
|
||||||
|
pass
|
||||||
|
|
||||||
|
filter_sizes = list(set(wildcard_sizes))
|
||||||
|
filter_codes = [str(wildcard_status)] if wildcard_status else []
|
||||||
|
|
||||||
|
if not filter_codes and not filter_sizes:
|
||||||
|
service.info(f'Could not establish wildcard baseline for {domain}. Skipping.')
|
||||||
|
continue
|
||||||
|
|
||||||
|
outfile = os.path.join(scandir, f"{protocol}_{port}_{domain}_subdomains_{name}.txt")
|
||||||
|
|
||||||
|
cmd = [
|
||||||
|
'ffuf',
|
||||||
|
'-u', ip_url,
|
||||||
|
'-H', f'Host: FUZZ.{domain}',
|
||||||
|
'-H', 'User-Agent: Vhost Finder',
|
||||||
|
'-w', wordlist,
|
||||||
|
'-t', str(self.get_option('threads')),
|
||||||
|
'-mc', 'all',
|
||||||
|
'-noninteractive',
|
||||||
|
'-s',
|
||||||
|
]
|
||||||
|
|
||||||
|
if filter_codes:
|
||||||
|
cmd += ['-fc', ','.join(filter_codes)]
|
||||||
|
if filter_sizes:
|
||||||
|
cmd += ['-fs', ','.join(str(s) for s in filter_sizes)]
|
||||||
|
|
||||||
|
proc = await asyncio.create_subprocess_exec(
|
||||||
|
*cmd,
|
||||||
|
stdout=asyncio.subprocess.PIPE,
|
||||||
|
stderr=asyncio.subprocess.DEVNULL,
|
||||||
|
)
|
||||||
|
|
||||||
|
with open(outfile, 'w') as f:
|
||||||
|
async for line in proc.stdout:
|
||||||
|
hit = line.decode(errors='replace').strip()
|
||||||
|
if hit and '#' not in hit:
|
||||||
|
f.write(hit + '\n')
|
||||||
|
f.flush()
|
||||||
|
|
||||||
|
await proc.wait()
|
||||||
|
|
@ -1,53 +1,105 @@
|
||||||
from autorecon.plugins import ServiceScan
|
from autorecon.plugins import ServiceScan
|
||||||
from shutil import which
|
import asyncio
|
||||||
import os, requests, random, string, urllib3
|
import requests
|
||||||
|
import urllib3
|
||||||
|
import os, random, string
|
||||||
|
|
||||||
urllib3.disable_warnings()
|
urllib3.disable_warnings()
|
||||||
|
|
||||||
class VirtualHost(ServiceScan):
|
class VirtualHost(ServiceScan):
|
||||||
|
def __init__(self):
|
||||||
|
super().__init__()
|
||||||
|
self.name = 'Virtual Host Enumeration'
|
||||||
|
self.slug = 'vhost-enum'
|
||||||
|
self.tags = ['default', 'safe', 'http', 'long']
|
||||||
|
|
||||||
def __init__(self):
|
def configure(self):
|
||||||
super().__init__()
|
self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s')
|
||||||
self.name = 'Virtual Host Enumeration'
|
self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s')
|
||||||
self.slug = 'vhost-enum'
|
self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s')
|
||||||
self.tags = ['default', 'safe', 'http', 'long']
|
self.match_service_name('^http')
|
||||||
|
self.match_service_name('^nacn_http$', negative_match=True)
|
||||||
|
|
||||||
def configure(self):
|
async def run(self, service):
|
||||||
self.add_option('hostname', help='The hostname to use as the base host (e.g. example.com) for virtual host enumeration. Default: %(default)s')
|
hostnames = []
|
||||||
self.add_list_option('wordlist', default=['/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt'], help='The wordlist(s) to use when enumerating virtual hosts. Separate multiple wordlists with spaces. Default: %(default)s')
|
if self.get_option('hostname'):
|
||||||
self.add_option('threads', default=10, help='The number of threads to use when enumerating virtual hosts. Default: %(default)s')
|
hostnames.append(self.get_option('hostname'))
|
||||||
self.match_service_name('^http')
|
if service.target.type == 'hostname' and service.target.address not in hostnames:
|
||||||
self.match_service_name('^nacn_http$', negative_match=True)
|
hostnames.append(service.target.address)
|
||||||
|
if self.get_global('domain') and self.get_global('domain') not in hostnames:
|
||||||
|
hostnames.append(self.get_global('domain'))
|
||||||
|
|
||||||
async def run(self, service):
|
if not hostnames:
|
||||||
hostnames = []
|
service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.')
|
||||||
if self.get_option('hostname'):
|
return
|
||||||
hostnames.append(self.get_option('hostname'))
|
|
||||||
if service.target.type == 'hostname' and service.target.address not in hostnames:
|
|
||||||
hostnames.append(service.target.address)
|
|
||||||
if self.get_global('domain') and self.get_global('domain') not in hostnames:
|
|
||||||
hostnames.append(self.get_global('domain'))
|
|
||||||
|
|
||||||
if len(hostnames) > 0:
|
scheme = 'https' if service.secure else 'http'
|
||||||
for wordlist in self.get_option('wordlist'):
|
ip_url = f"{scheme}://{service.target.address}:{service.port}/"
|
||||||
name = os.path.splitext(os.path.basename(wordlist))[0]
|
scandir = os.path.join(service.target.scandir, f"{service.protocol}{service.port}")
|
||||||
for hostname in hostnames:
|
protocol = service.protocol
|
||||||
try:
|
port = service.port
|
||||||
wildcard = requests.get(
|
|
||||||
('https' if service.secure else 'http') + '://' + service.target.address + ':' + str(service.port) + '/',
|
|
||||||
headers={'Host': ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + hostname},
|
|
||||||
verify=False,
|
|
||||||
allow_redirects=False
|
|
||||||
)
|
|
||||||
size = str(len(wildcard.content))
|
|
||||||
except requests.exceptions.RequestException as e:
|
|
||||||
service.error(f"[!] Wildcard request failed for {hostname}: {e}")
|
|
||||||
continue
|
|
||||||
|
|
||||||
await service.execute(
|
for wordlist in self.get_option('wordlist'):
|
||||||
'ffuf -u {http_scheme}://' + hostname + ':{port}/ -t ' + str(self.get_option('threads')) +
|
name = os.path.splitext(os.path.basename(wordlist))[0]
|
||||||
' -w ' + wordlist + ' -H "Host: FUZZ.' + hostname + '" -mc all -fs ' + size +
|
|
||||||
' -r -noninteractive -s | tee "{scandir}/{protocol}_{port}_{http_scheme}_' + hostname + '_vhosts_' + name + '.txt"'
|
for hostname in hostnames:
|
||||||
)
|
# Wildcard probe — get baseline status and size
|
||||||
else:
|
wildcard_status = None
|
||||||
service.info('The target was not a hostname, nor was a hostname provided as an option. Skipping virtual host enumeration.')
|
wildcard_sizes = []
|
||||||
|
|
||||||
|
for i in range(3):
|
||||||
|
fuzz_host = ''.join(random.choice(string.ascii_letters) for _ in range(20)) + '.' + hostname
|
||||||
|
try:
|
||||||
|
resp = await asyncio.to_thread(
|
||||||
|
requests.get,
|
||||||
|
ip_url,
|
||||||
|
headers={'Host': fuzz_host, 'User-Agent': 'Vhost Finder'},
|
||||||
|
verify=False,
|
||||||
|
allow_redirects=False,
|
||||||
|
timeout=10,
|
||||||
|
)
|
||||||
|
wildcard_status = resp.status_code
|
||||||
|
wildcard_sizes.append(len(resp.content))
|
||||||
|
except requests.exceptions.RequestException:
|
||||||
|
pass
|
||||||
|
|
||||||
|
filter_sizes = list(set(wildcard_sizes))
|
||||||
|
filter_codes = [str(wildcard_status)] if wildcard_status else []
|
||||||
|
|
||||||
|
if not filter_codes and not filter_sizes:
|
||||||
|
service.info(f'Could not establish wildcard baseline for {hostname}. Skipping.')
|
||||||
|
continue
|
||||||
|
|
||||||
|
outfile = os.path.join(scandir, f"{protocol}_{port}_{scheme}_{hostname}_vhosts_{name}.txt")
|
||||||
|
|
||||||
|
cmd = [
|
||||||
|
'ffuf',
|
||||||
|
'-u', ip_url,
|
||||||
|
'-H', f'Host: FUZZ.{hostname}',
|
||||||
|
'-H', 'User-Agent: Vhost Finder',
|
||||||
|
'-w', wordlist,
|
||||||
|
'-t', str(self.get_option('threads')),
|
||||||
|
'-mc', 'all',
|
||||||
|
'-noninteractive',
|
||||||
|
'-s',
|
||||||
|
]
|
||||||
|
|
||||||
|
if filter_codes:
|
||||||
|
cmd += ['-fc', ','.join(filter_codes)]
|
||||||
|
if filter_sizes:
|
||||||
|
cmd += ['-fs', ','.join(str(s) for s in filter_sizes)]
|
||||||
|
|
||||||
|
proc = await asyncio.create_subprocess_exec(
|
||||||
|
*cmd,
|
||||||
|
stdout=asyncio.subprocess.PIPE,
|
||||||
|
stderr=asyncio.subprocess.DEVNULL,
|
||||||
|
)
|
||||||
|
|
||||||
|
with open(outfile, 'w') as f:
|
||||||
|
async for line in proc.stdout:
|
||||||
|
hit = line.decode(errors='replace').strip()
|
||||||
|
if hit and '#' not in hit:
|
||||||
|
f.write(hit + '\n')
|
||||||
|
f.flush()
|
||||||
|
|
||||||
|
await proc.wait()
|
||||||
Loading…
Reference in New Issue