diff --git a/modes/normal.sh b/modes/normal.sh index 460de3c..536d802 100644 --- a/modes/normal.sh +++ b/modes/normal.sh @@ -57,7 +57,7 @@ echo -e "${OKGREEN}============================================================= dig all +short $TARGET > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null host $TARGET 2> /dev/null | grep address 2> /dev/null | awk '{print $4}' 2> /dev/null >> $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null -dnsenum $TARGET 2> /dev/null +dnsenum -f $INSTALL_DIR/wordlists/vhosts.txt --noreverse $TARGET 2> /dev/null mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" diff --git a/modes/stealth.sh b/modes/stealth.sh index c8d6580..3eb7627 100644 --- a/modes/stealth.sh +++ b/modes/stealth.sh @@ -101,9 +101,8 @@ if [ "$MODE" = "stealth" ]; then dig all +short $TARGET > $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null dig all +short -x $TARGET >> $LOOT_DIR/nmap/dns-$TARGET.txt 2> /dev/null host $TARGET 2> /dev/null | grep address 2> /dev/null | awk '{print $4}' 2> /dev/null >> $LOOT_DIR/ips/ips-all-unsorted.txt 2> /dev/null - dnsenum $TARGET 2> /dev/null | tee $LOOT_DIR/output/dnsenum-$TARGET.txt 2> /dev/null + dnsenum -f $INSTALL_DIR/wordlists/vhosts.txt --noreverse $TARGET 2> /dev/null mv -f *_ips.txt $LOOT_DIR/domains/ 2>/dev/null - if [ $SCAN_TYPE == "DOMAIN" ]; then echo -e "${OKGREEN}====================================================================================${RESET}•x${OKGREEN}[`date +"%Y-%m-%d](%H:%M)"`${RESET}x•" diff --git a/wordlists/vhosts.txt b/wordlists/vhosts.txt new file mode 100644 index 0000000..8dc8701 --- /dev/null +++ b/wordlists/vhosts.txt @@ -0,0 +1,141 @@ +127.0.0.1 +admin +administration +ads +adserver +alerts +alpha +ap +apache +api +app +apps +appserver +aptest +auth +backup +beta +blog +cdn +chat +citrix +cms +corp +crs +cvs +dashboard +database +db +demo +dev +devel +development +devsql +devtest +dhcp +direct +dmz +dns +dns0 +dns1 +dns2 +download +en +erp +eshop +exchange +f5 +fileserver +firewall +forum +ftp +ftp0 +git +gw +help +helpdesk +home +host +http +id +images +info +internal +internet +intra +intranet +ipv6 +lab +ldap +linux +local +localhost +log +m +mail +mail2 +mail3 +mailgate +main +manage +mgmt +mirror +mobile +monitor +mssql +mta +mx +mx0 +mx1 +mysql +news +noc +ns +ns0 +ns1 +ns2 +ns3 +ntp +old +ops +oracle +owa +pbx +portal +s3 +secure +server +sharepoint +shop +sip +smtp +sql +squid +ssh +ssl +stage +staging +stats +status +svn +syslog +test +test1 +test2 +testing +uat +upload +v1 +v2 +v3 +vm +vnc +voip +vpn +web +web2test +whois +wiki +www +www2 +xml \ No newline at end of file