.*?
(.*?)',re.S)
+ try:
+ links = link_regx.findall(resp)
+ for link in links:
+ subdomain = link.strip()
+ if not subdomain.endswith(self.domain):
+ continue
+ if subdomain not in self.subdomains and subdomain != self.domain:
+ if verbose:
+ print "%s%s: %s%s"%(R, self.engine_name, W, subdomain)
+ self.subdomains.append(subdomain)
+ except Exception as e:
+ pass
+
+
+
+class CrtSearch(multiprocessing.Process):
+ def __init__(self, domain, subdomains=None, q=None, lock=threading.Lock()):
+ subdomains = subdomains or []
+ self.base_url = 'https://crt.sh/?q=%25.{domain}'
+ self.domain = urlparse.urlparse(domain).netloc
+ self.subdomains = []
+ self.session = requests.Session()
+ self.engine_name = "SSL Certificates"
+ multiprocessing.Process.__init__(self)
+ self.lock = lock
+ self.q = q
+ self.timeout = 25
+ self.print_banner()
+ return
+
+ def run(self):
+ domain_list = self.enumerate()
+ for domain in domain_list:
+ self.q.append(domain)
+ return
+
+ def print_banner(self):
+ print G+"[-] Searching now in %s.." %(self.engine_name)+W
+ return
+
+ def req(self, url):
+ headers = {'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/40.0',
+ 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+ 'Accept-Language': 'en-GB,en;q=0.5',
+ 'Accept-Encoding': 'gzip, deflate',
+ }
+
+ try:
+ resp = self.session.get(url, headers=headers, timeout=self.timeout)
+ except Exception as e:
+ return 0
+
+ return self.get_response(resp)
+
+ def get_response(self,response):
+ if hasattr(response, "text"):
+ return response.text
+ else:
+ return response.content
+
+ def enumerate(self):
+ url = self.base_url.format(domain=self.domain)
+ resp = self.req(url)
+ if resp:
+ self.extract_domains(resp)
+ return self.subdomains
+
+ def extract_domains(self, resp):
+ link_regx = re.compile('
(.*?) | ')
+ try:
+ links = link_regx.findall(resp)
+ for link in links:
+ subdomain = link.strip()
+ if not subdomain.endswith(self.domain) or '*' in subdomain:
+ continue
+ if subdomain not in self.subdomains and subdomain != self.domain:
+ if verbose:
+ print "%s%s: %s%s"%(R, self.engine_name, W, subdomain)
+ self.subdomains.append(subdomain)
+ except Exception as e:
+ pass
+
+class PassiveDNS(multiprocessing.Process):
+ def __init__(self, domain, subdomains=None, q=None, lock=threading.Lock()):
+ subdomains = subdomains or []
+ self.base_url = 'http://ptrarchive.com/tools/search.htm?label={domain}'
+ self.domain = urlparse.urlparse(domain).netloc
+ self.subdomains = []
+ self.session = requests.Session()
+ self.engine_name = "PassiveDNS"
+ multiprocessing.Process.__init__(self)
+ self.lock = lock
+ self.q = q
+ self.timeout = 25
+ self.print_banner()
+ return
+
+ def run(self):
+ domain_list = self.enumerate()
+ for domain in domain_list:
+ self.q.append(domain)
+ return
+
+ def print_banner(self):
+ print G+"[-] Searching now in %s.." %(self.engine_name)+W
+ return
+
+ def req(self, url):
+ headers = {'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/40.0',
+ 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+ 'Accept-Language': 'en-GB,en;q=0.5',
+ 'Accept-Encoding': 'gzip, deflate',
+ }
+
+ try:
+ resp = self.session.get(url, headers=headers, timeout=self.timeout)
+ except Exception as e:
+ print e
+ return 0
+
+ return self.get_response(resp)
+
+ def get_response(self,response):
+ if hasattr(response, "text"):
+ return response.text
+ else:
+ return response.content
+
+ def enumerate(self):
+ url = self.base_url.format(domain=self.domain)
+ resp = self.req(url)
+ self.extract_domains(resp)
+ return self.subdomains
+
+ def extract_domains(self, resp):
+ link_regx = re.compile('
(.*?) | ')
+ try:
+ links = link_regx.findall(resp)
+ for link in links:
+ if self.domain not in link:
+ continue
+ subdomain = link[:link.find('[')]
+ if subdomain not in self.subdomains and subdomain != self.domain:
+ if verbose:
+ print "%s%s: %s%s"%(R, self.engine_name, W, subdomain)
+ self.subdomains.append(subdomain)
+ except Exception as e:
+ pass
+
+class portscan():
+
+ def __init__(self,subdomains,ports):
+ self.subdomains = subdomains
+ self.ports = ports
+ self.threads = 20
+ self.lock = threading.BoundedSemaphore(value=self.threads)
+
+ def port_scan(self,host,ports):
+ openports = []
+ self.lock.acquire()
+ for port in ports:
+ try:
+ s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+ s.settimeout(1)
+ result = s.connect_ex((host, int(port)))
+ if result == 0:
+ openports.append(port)
+ s.close
+ except Exception as e:
+ pass
+ self.lock.release()
+ if len(openports) > 0:
+ print "%s%s%s - %sFound open ports:%s %s%s%s"%(G,host,W,R,W,Y,', '.join(openports),W)
+
+ def run(self):
+ for subdomain in self.subdomains:
+ t = threading.Thread(target=self.port_scan,args=(subdomain,self.ports))
+ t.start()
def main():
args = parse_args()
domain = args.domain
threads = args.threads
savefile = args.output
+ ports = args.ports
google_list = []
bing_list = []
baidu_list = []
bruteforce_list = set()
- subdomains_queue = multiprocessing.Queue()
+ search_list = set()
+ subdomains_queue = multiprocessing.Manager().list()
#Check Verbosity
global verbose
@@ -673,16 +918,18 @@ def main():
print Y+"[-] verbosity is enabled, will show the subdomains results in realtime"+W
#Start the engines enumeration
- enums = [enum(domain, verbose, q=subdomains_queue) for enum in BaiduEnum,
- YahooEnum, GoogleEnum, BingEnum, AskEnum, NetcraftEnum, DNSdumpster]
+ enums = [enum(domain, verbose, q=subdomains_queue) for enum in BaiduEnum, YahooEnum, GoogleEnum, BingEnum, AskEnum, NetcraftEnum, DNSdumpster, Virustotal, CrtSearch, PassiveDNS]
for enum in enums:
enum.start()
for enum in enums:
enum.join()
+
+
- search_list = set()
- while not subdomains_queue.empty():
- search_list= search_list.union(subdomains_queue.get())
+
+ subdomains = set(subdomains_queue)
+ for subdomain in subdomains:
+ search_list.add(subdomain)
if enable_bruteforce:
print G+"[-] Starting bruteforce module now using subbrute.."+W
@@ -698,12 +945,21 @@ def main():
subdomains = search_list.union(bruteforce_list)
if subdomains:
+ subdomains = sorted(subdomains)
if savefile:
write_file(savefile, subdomains)
+
print Y+"[-] Total Unique Subdomains Found: %s"%len(subdomains)+W
- subdomains = sorted(set(subdomains))
- for subdomain in subdomains:
- print G+subdomain+W
-
+
+ if ports:
+ print G+"[-] Start port scan now for the following ports: %s%s"%(Y,ports)+W
+ ports = ports.split(',')
+ pscan = portscan(subdomains,ports)
+ pscan.run()
+
+ else:
+ for subdomain in subdomains:
+ print G+subdomain+W
+
if __name__=="__main__":
main()