From c3b1abc73d429b7dee665b8b950765112e9941c2 Mon Sep 17 00:00:00 2001
From: Abdelrahman Hesham <ahesham93@gmail.com>
Date: Sat, 12 Oct 2019 12:54:34 +0200
Subject: [PATCH] Fix Virustotal search

---
 sublist3r.py | 37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/sublist3r.py b/sublist3r.py
index 109dacd..ffc7111 100755
--- a/sublist3r.py
+++ b/sublist3r.py
@@ -669,11 +669,12 @@ class DNSdumpster(enumratorBaseThreaded):
 class Virustotal(enumratorBaseThreaded):
     def __init__(self, domain, subdomains=None, q=None, silent=False, verbose=True):
         subdomains = subdomains or []
-        base_url = 'https://www.virustotal.com/en/domain/{domain}/information/'
+        base_url = 'https://www.virustotal.com/ui/domains/{domain}/subdomains'
         self.engine_name = "Virustotal"
         self.lock = threading.Lock()
         self.q = q
         super(Virustotal, self).__init__(base_url, self.engine_name, domain, subdomains, q=q, silent=silent, verbose=verbose)
+        self.url = self.base_url.format(domain=self.domain)
         return
 
     # the main send_req need to be rewritten
@@ -688,23 +689,31 @@ class Virustotal(enumratorBaseThreaded):
 
     # once the send_req is rewritten we don't need to call this function, the stock one should be ok
     def enumerate(self):
-        url = self.base_url.format(domain=self.domain)
-        resp = self.send_req(url)
-        self.extract_domains(resp)
+        while self.url != '':
+            resp = self.send_req(self.url)
+            resp = json.loads(resp)
+            if 'error' in resp:
+                self.print_(R + "[!] Error: Virustotal probably now is blocking our requests" + W)
+                break
+            if 'links' in resp and 'next' in resp['links']:
+                self.url = resp['links']['next']
+            else:
+                self.url = ''
+            self.extract_domains(resp)
         return self.subdomains
 
     def extract_domains(self, resp):
-        link_regx = re.compile('<div class="enum.*?">.*?<a target="_blank" href=".*?">(.*?)</a>', re.S)
+        #resp is already parsed as json
         try:
-            links = link_regx.findall(resp)
-            for link in links:
-                subdomain = link.strip()
-                if not subdomain.endswith(self.domain):
-                    continue
-                if subdomain not in self.subdomains and subdomain != self.domain:
-                    if self.verbose:
-                        self.print_("%s%s: %s%s" % (R, self.engine_name, W, subdomain))
-                    self.subdomains.append(subdomain.strip())
+            for i in resp['data']:
+                if i['type'] == 'domain':
+                    subdomain = i['id']
+                    if not subdomain.endswith(self.domain):
+                        continue
+                    if subdomain not in self.subdomains and subdomain != self.domain:
+                        if self.verbose:
+                            self.print_("%s%s: %s%s" % (R, self.engine_name, W, subdomain))
+                        self.subdomains.append(subdomain.strip())
         except Exception:
             pass