(.*?)', re.S)
link_regex = re.compile('(.*?)
', re.S)
links = []
try:
@@ -881,7 +995,7 @@ class portscan():
t.start()
-def main(domain, threads, savefile, ports, silent, verbose, enable_bruteforce, engines):
+def main(domain, threads, savefile, ports, silent, verbose, enable_bruteforce, engines, portscan=False, output_format='raw', no_resolve=False):
bruteforce_list = set()
search_list = set()
@@ -891,11 +1005,11 @@ def main(domain, threads, savefile, ports, silent, verbose, enable_bruteforce, e
subdomains_queue = multiprocessing.Manager().list()
# Check Bruteforce Status
- if enable_bruteforce or enable_bruteforce is None:
+ if enable_bruteforce:
enable_bruteforce = True
# Validate domain
- domain_check = re.compile("^(http|https)?[a-zA-Z0-9]+([\-\.]{1}[a-zA-Z0-9]+)*\.[a-zA-Z]{2,}$")
+ domain_check = re.compile(r"^(http|https)?[a-zA-Z0-9]+([\-\.]{1}[a-zA-Z0-9]+)*\.[a-zA-Z]{2,}$")
if not domain_check.match(domain):
if not silent:
print(R + "Error: Please enter a valid domain" + W)
@@ -922,7 +1036,8 @@ def main(domain, threads, savefile, ports, silent, verbose, enable_bruteforce, e
'virustotal': Virustotal,
'threatcrowd': ThreatCrowd,
'ssl': CrtSearch,
- 'passivedns': PassiveDNS
+ 'passivedns': PassiveDNS,
+ 'hackertarget':HackertargetEnum
}
chosenEnums = []
@@ -930,8 +1045,8 @@ def main(domain, threads, savefile, ports, silent, verbose, enable_bruteforce, e
if engines is None:
chosenEnums = [
BaiduEnum, YahooEnum, GoogleEnum, BingEnum, AskEnum,
- NetcraftEnum, DNSdumpster, Virustotal, ThreatCrowd,
- CrtSearch, PassiveDNS
+ NetcraftEnum, ThreatCrowd,
+ CrtSearch, PassiveDNS, HackertargetEnum,Virustotal
]
else:
engines = engines.split(',')
@@ -967,8 +1082,20 @@ def main(domain, threads, savefile, ports, silent, verbose, enable_bruteforce, e
if subdomains:
subdomains = sorted(subdomains, key=subdomain_sorting_key)
+ ip_map = None
+ if not no_resolve:
+ ip_map = resolve_ips(subdomains)
+
+ portscan_results = None
+ if portscan:
+ if not silent:
+ print(G + "[-] Starting Shodan InternetDB port scan.." + W)
+ portscan_results = portscan_shodan(subdomains, ip_map)
+ if not silent:
+ print(G + "[-] Shodan InternetDB port scan completed" + W)
+
if savefile:
- write_file(savefile, subdomains)
+ write_file(savefile, subdomains, output_format=output_format, port_scan_results=portscan_results, ip_map=ip_map)
if not silent:
print(Y + "[-] Total Unique Subdomains Found: %s" % len(subdomains) + W)
@@ -980,9 +1107,63 @@ def main(domain, threads, savefile, ports, silent, verbose, enable_bruteforce, e
pscan = portscan(subdomains, ports)
pscan.run()
- elif not silent:
- for subdomain in subdomains:
- print(G + subdomain + W)
+ if not silent:
+ if output_format == 'json':
+ output = {}
+ items = []
+ for subdomain in subdomains:
+ item = {'subdomain': subdomain}
+ if ip_map and subdomain in ip_map:
+ item['ip'] = ip_map[subdomain]
+ if portscan_results and subdomain in portscan_results:
+ item['ports'] = portscan_results[subdomain]['ports']
+ items.append(item)
+ if portscan_results:
+ output['port_scan'] = portscan_results
+ output['subdomains'] = items
+ print(json.dumps(output, separators=(',', ':')))
+ elif output_format == 'markdown':
+ print("# Sublist3r Results\n")
+ print("## Subdomains\n")
+ if ip_map:
+ print("| Subdomain | IP |")
+ print("|-----------|-----|")
+ for subdomain in subdomains:
+ ip = ip_map.get(subdomain, '')
+ print("| %s | %s |" % (subdomain, ip))
+ else:
+ for subdomain in subdomains:
+ print("- %s" % subdomain)
+ if portscan_results:
+ print("\n## Port Scan Results\n")
+ print("| Subdomain | IP | Ports |")
+ print("|-----------|-----|-------|")
+ for subdomain, data in portscan_results.items():
+ ip = data.get('ip', '')
+ ports_str = ', '.join(str(p) for p in data.get('ports', []))
+ print("| %s | %s | %s |" % (subdomain, ip, ports_str))
+ else:
+ if portscan_results:
+ for subdomain in subdomains:
+ ip = ip_map.get(subdomain, '') if ip_map else ''
+ if subdomain in portscan_results:
+ data = portscan_results[subdomain]
+ pports = ', '.join(str(p) for p in data.get('ports', []))
+ if ip:
+ print("%s,%s,%s" % (subdomain, ip, pports))
+ else:
+ print("%s,%s" % (subdomain, pports))
+ else:
+ if ip:
+ print("%s,%s" % (subdomain, ip))
+ else:
+ print(G + subdomain + W)
+ else:
+ for subdomain in subdomains:
+ if ip_map and subdomain in ip_map:
+ print("%s,%s" % (subdomain, ip_map[subdomain]))
+ else:
+ print(G + subdomain + W)
return subdomains
@@ -1000,7 +1181,7 @@ def interactive():
if args.no_color:
no_color()
banner()
- res = main(domain, threads, savefile, ports, silent=False, verbose=verbose, enable_bruteforce=enable_bruteforce, engines=engines)
+ res = main(domain, threads, savefile, ports, silent=False, verbose=verbose, enable_bruteforce=enable_bruteforce, engines=engines, portscan=args.portscan, output_format=args.output_format, no_resolve=args.no_resolve)
if __name__ == "__main__":
interactive()
|