|
| 1 | +# !/usr/bin/env python |
| 2 | +# -*- coding:utf-8 -*- |
| 3 | +__author__ = 'bit4' |
| 4 | +__github__ = 'https://github.com/bit4woo' |
| 5 | + |
| 6 | + |
| 7 | +import argparse |
| 8 | +import datetime |
| 9 | +import os |
| 10 | +import threading |
| 11 | +import Queue |
| 12 | + |
| 13 | +from brute.subDomainsBrute import SubNameBrute |
| 14 | + |
| 15 | +from domainsites.Alexa import Alexa |
| 16 | +from domainsites.Chaxunla import Chaxunla |
| 17 | +from domainsites.CrtSearch import CrtSearch |
| 18 | +from domainsites.DNSdumpster import DNSdumpster |
| 19 | +from domainsites.Googlect import Googlect |
| 20 | +from domainsites.Hackertarget import Hackertarget |
| 21 | +from domainsites.Ilink import Ilink |
| 22 | +from domainsites.Netcraft import Netcraft |
| 23 | +from domainsites.PassiveDNS import PassiveDNS |
| 24 | +from domainsites.Pgpsearch import Pgpsearch |
| 25 | +from domainsites.Sitedossier import Sitedossier |
| 26 | +from domainsites.ThreatCrowd import ThreatCrowd |
| 27 | +from domainsites.Threatminer import Threatminer |
| 28 | +from domainsites.Virustotal import Virustotal |
| 29 | +from lib.common import * |
| 30 | +from lib.domain2ip import domains2ips,iprange |
| 31 | +from lib.colorlog import * |
| 32 | +from lib.zonetransfer import zonetransfer |
| 33 | +from searchengine.search_ask import search_ask |
| 34 | +from searchengine.search_baidu import search_baidu |
| 35 | +from searchengine.search_bing import search_bing |
| 36 | +from searchengine.search_bing_api import search_bing_api |
| 37 | +from searchengine.search_dogpile import search_dogpile |
| 38 | +from searchengine.search_duckduckgo import search_duckduckgo |
| 39 | +from searchengine.search_exalead import search_exalead |
| 40 | +from searchengine.search_fofa import search_fofa |
| 41 | +from searchengine.search_google import search_google |
| 42 | +from searchengine.search_google_cse import search_google_cse |
| 43 | +from searchengine.search_shodan import search_shodan |
| 44 | +from searchengine.search_so import search_so |
| 45 | +from searchengine.search_yahoo import search_yahoo |
| 46 | +from searchengine.search_yandex import search_yandex |
| 47 | + |
| 48 | +reload(sys) |
| 49 | +sys.setdefaultencoding('utf-8') |
| 50 | +sys.dont_write_bytecode = True |
| 51 | + |
| 52 | +try: |
| 53 | + import urllib3 |
| 54 | + urllib3.disable_warnings() |
| 55 | +except: |
| 56 | + pass |
| 57 | + |
| 58 | + |
| 59 | +def parser_error(errmsg): |
| 60 | + banner() |
| 61 | + print ("Usage: python "+sys.argv[0]+" [Options] use -h for help") |
| 62 | + logger.error("Error: "+errmsg) |
| 63 | + sys.exit() |
| 64 | + |
| 65 | +def parse_args(): #optparse模块从2.7开始废弃，建议使用argparse |
| 66 | + parser = argparse.ArgumentParser(epilog = '\tExample: \r\npython '+sys.argv[0]+" -d google.com") |
| 67 | + parser.error = parser_error |
| 68 | + parser._optionals.title = "OPTIONS" |
| 69 | + parser.add_argument('-d', '--domain', help="Domain name to enumrate it's subdomains", required=True) |
| 70 | + parser.add_argument('-b', '--bruteforce', help='Enable the subbrute bruteforce module',nargs='?', default=False) |
| 71 | + parser.add_argument('-o', '--output', help='Save the results to text file') |
| 72 | + parser.add_argument('-x', '--proxy', help='The http proxy to visit google,eg: http://127.0.0.1:8080 ') |
| 73 | + return parser.parse_args() |
| 74 | + |
| 75 | +def adjust_args(): |
| 76 | + args = parse_args() |
| 77 | + # Validate domain |
| 78 | + if not is_domain(args.domain): |
| 79 | + logger.error("Please enter a valid domain!!!") |
| 80 | + sys.exit() |
| 81 | + |
| 82 | + if not args.output: |
| 83 | + now = datetime.datetime.now() |
| 84 | + timestr = now.strftime("-%Y-%m-%d-%H-%M") |
| 85 | + args.output = args.domain + timestr + ".txt" |
| 86 | + args.output = os.path.join(os.path.dirname(__file__), "output", args.output) |
| 87 | + |
| 88 | + if args.proxy != None: |
| 89 | + proxy = {args.proxy.split(":")[0]: args.proxy} |
| 90 | + elif default_proxies != None and (proxy_switch == 2 or proxy_switch == 1): # config.py |
| 91 | + proxy = default_proxies |
| 92 | + else: |
| 93 | + proxy = {} |
| 94 | + |
| 95 | + args.proxy = proxy_verify(proxy) |
| 96 | + if len(args.proxy) !=0: |
| 97 | + logger.info("Vailid Proxy: {0}".format(args.proxy)) |
| 98 | + else: |
| 99 | + logger.info("Caution! No valid proxy detected. No proxy will be used in this run.") |
| 100 | + return args |
| 101 | + |
| 102 | +def callengines_thread(engine, key_word, q_domains, q_emails, proxy=None,limit=1000): |
| 103 | + x = engine(key_word, limit, proxy) |
| 104 | + domains,emails = x.run() |
| 105 | + if domains: # domains maybe None |
| 106 | + for domain in domains: |
| 107 | + q_domains.put(domain) |
| 108 | + if emails: |
| 109 | + for email in emails: |
| 110 | + q_emails.put(email) |
| 111 | + |
| 112 | +def callsites_thread(engine, key_word, q_domains, q_similiar_domains, q_related_domains, q_emails, proxy=None): |
| 113 | + enum = engine(key_word,proxy) |
| 114 | + domains,similar_domains,related_domains,emails = enum.run() |
| 115 | + if domains: |
| 116 | + for domain in domains: |
| 117 | + q_domains.put(domain) |
| 118 | + if similar_domains: |
| 119 | + for item in similar_domains: |
| 120 | + q_similiar_domains.put(item) #put both domain and similar in domain set |
| 121 | + if related_domains: #domains that found by cert |
| 122 | + for item in related_domains: |
| 123 | + q_related_domains.put(item) |
| 124 | + if emails: |
| 125 | + for item in emails: |
| 126 | + q_emails.put(item) |
| 127 | + #return list(set(final_domains)) |
| 128 | + |
| 129 | +def main(): |
| 130 | + args = adjust_args() |
| 131 | + |
| 132 | + print "[-] Enumerating subdomains now for %s" % args.domain |
| 133 | + |
| 134 | + #doing zone transfer checking |
| 135 | + zonetransfer(args.domain).check() |
| 136 | + |
| 137 | + #all possible result parameters |
| 138 | + Result_Sub_Domains = [] |
| 139 | + Result_Similar_Domains =[] |
| 140 | + Result_Related_Domains =[] |
| 141 | + Result_Emails = [] |
| 142 | + Result_Subnets =[] |
| 143 | + |
| 144 | + Temp_IP_List =[] |
| 145 | + Domain_IP_Records =[] |
| 146 | + |
| 147 | + |
| 148 | + |
| 149 | + ################using search engine and web api to query subdomains and related domains##################### |
| 150 | + Threadlist = [] |
| 151 | + q_domains = Queue.Queue() #to recevie return values,use it to ensure thread safe. |
| 152 | + q_similar_domains = Queue.Queue() |
| 153 | + q_related_domains = Queue.Queue() |
| 154 | + q_emails = Queue.Queue() |
| 155 | + |
| 156 | + |
| 157 | + for engine in [Alexa, Chaxunla, CrtSearch, DNSdumpster, Googlect, Hackertarget, Ilink, Netcraft, PassiveDNS, Pgpsearch, Sitedossier, ThreatCrowd, Threatminer,Virustotal]: |
| 158 | + #print callsites_thread(engine,domain,proxy) |
| 159 | + #print engine.__name__ |
| 160 | + if proxy_switch == 1 and engine.__name__ in proxy_default_enabled: |
| 161 | + proxy = args.proxy #通过配置或者参数获取到的proxy |
| 162 | + else: |
| 163 | + proxy ={} #不使用proxy |
| 164 | + t = threading.Thread(target=callsites_thread, args=(engine, args.domain, q_domains, q_similar_domains, q_related_domains, q_emails, proxy)) |
| 165 | + Threadlist.append(t) |
| 166 | + |
| 167 | + for engine in [search_ask,search_baidu,search_bing,search_bing_api,search_dogpile,search_duckduckgo,search_exalead,search_fofa,search_google,search_google_cse, |
| 168 | + search_shodan,search_so,search_yahoo,search_yandex]: |
| 169 | + if proxy_switch == 1 and engine.__name__ in proxy_default_enabled: |
| 170 | + proxy = args.proxy |
| 171 | + else: |
| 172 | + proxy ={} |
| 173 | + t = threading.Thread(target=callengines_thread, args=(engine, args.domain, q_domains, q_emails, proxy, 500)) |
| 174 | + t.setDaemon(True) #变成守护进程，独立于主进程。这里好像不需要 |
| 175 | + Threadlist.append(t) |
| 176 | + |
| 177 | + #for t in Threadlist: |
| 178 | + # print t |
| 179 | + for t in Threadlist: # use start() not run() |
| 180 | + t.start() |
| 181 | + for t in Threadlist: #为什么需要2次循环，不能在一次循环中完成？ |
| 182 | + t.join() #主线程将等待这个线程，直到这个线程运行结束 |
| 183 | + |
| 184 | + while not q_domains.empty(): |
| 185 | + Result_Sub_Domains.append(q_domains.get()) |
| 186 | + while not q_emails.empty(): |
| 187 | + Result_Emails.append(q_emails.get()) |
| 188 | + while not q_related_domains.empty(): |
| 189 | + Result_Related_Domains.append(q_related_domains.get()) |
| 190 | + |
| 191 | + ################using subDomainsBrute to get more subdomains##################### |
| 192 | + if args.bruteforce: |
| 193 | + print G+"[-] Starting bruteforce using subDomainsBrute.."+W |
| 194 | + d = SubNameBrute(target=args.domain) |
| 195 | + d.run() |
| 196 | + Domain_IP_Records.extend(d.result_lines) |
| 197 | + Result_Sub_Domains.extend(d.result_domains) |
| 198 | + Temp_IP_List.extend(d.result_ips) |
| 199 | + |
| 200 | + |
| 201 | + |
| 202 | + #############do some deal############# |
| 203 | + ips, lines = domains2ips(Result_Sub_Domains) |
| 204 | + Temp_IP_List.extend(ips) |
| 205 | + Domain_IP_Records.extend(lines) |
| 206 | + |
| 207 | + |
| 208 | + Result_Subnets.extend(iprange(Temp_IP_List)) #1. IP段 |
| 209 | + Result_Sub_Domains = sorted(list(set(tolower_list(Result_Sub_Domains))))#2. 子域名,包括爆破所得 |
| 210 | + Domain_IP_Records = list(set(Domain_IP_Records)) #3. 域名和IP的解析记录 |
| 211 | + Result_Emails = sorted(list(set(Result_Emails))) #4. 邮箱 |
| 212 | + Result_Related_Domains = sorted(list(set(Result_Related_Domains))) # 5. 相关域名 |
| 213 | + |
| 214 | + ToPrint = Result_Sub_Domains#this function return value is NoneType ,can't use in function directly |
| 215 | + ToPrint.extend(Result_Emails) |
| 216 | + ToPrint.extend(Result_Subnets) |
| 217 | + ToPrint.extend(Result_Related_Domains) |
| 218 | + |
| 219 | + jsonString = "{'Result_Sub_Domains':{0},'Result_Emails':{1},'Result_Subnets':{2},'Result_Related_Domains':{3}}"\ |
| 220 | + .format(Result_Sub_Domains,Result_Emails,Result_Subnets,Result_Related_Domains) |
| 221 | + print jsonString |
| 222 | + return jsonString |
| 223 | + |
| 224 | + |
| 225 | +if __name__=="__main__": |
| 226 | + main() |
0 commit comments