(.*?)', re.S)\n link_regex = re.compile('(.*?)
', re.S)\n links = []\n try:\n results_tbl = tbl_regex.findall(resp)[0]\n except IndexError:\n results_tbl = ''\n links_list = link_regex.findall(results_tbl)\n links = list(set(links_list))\n for link in links:\n subdomain = link.strip()\n if not subdomain.endswith(self.domain):\n continue\n if subdomain and subdomain not in self.subdomains and subdomain != self.domain:\n self.subdomains.append(subdomain.strip())\n return links\n\n\nclass Virustotal(enumratorBaseThreaded):\n def __init__(self, domain, subdomains=None, q=None, silent=False, verbose=True):\n subdomains = subdomains or []\n base_url = 'https://www.virustotal.com/ui/domains/{domain}/subdomains'\n self.engine_name = \"Virustotal\"\n self.q = q\n super(Virustotal, self).__init__(base_url, self.engine_name, domain, subdomains, q=q, silent=silent, verbose=verbose)\n self.url = self.base_url.format(domain=self.domain)\n return\n\n # the main send_req need to be rewritten\n def send_req(self, url):\n try:\n resp = self.session.get(url, headers=self.headers, timeout=self.timeout)\n except Exception as e:\n self.print_(e)\n resp = None\n\n return self.get_response(resp)\n\n # once the send_req is rewritten we don't need to call this function, the stock one should be ok\n def enumerate(self):\n while self.url != '':\n resp = self.send_req(self.url)\n resp = json.loads(resp)\n if 'error' in resp:\n self.print_(R + \"[!] Error: Virustotal probably now is blocking our requests\" + W)\n break\n if 'links' in resp and 'next' in resp['links']:\n self.url = resp['links']['next']\n else:\n self.url = ''\n self.extract_domains(resp)\n return self.subdomains\n\n def extract_domains(self, resp):\n #resp is already parsed as json\n try:\n for i in resp['data']:\n if i['type'] == 'domain':\n subdomain = i['id']\n if not subdomain.endswith(self.domain):\n continue\n if subdomain not in self.subdomains and subdomain != self.domain:\n if self.verbose:\n self.print_(\"%s%s: %s%s\" % (R, self.engine_name, W, subdomain))\n self.subdomains.append(subdomain.strip())\n except Exception:\n pass\n\n\nclass ThreatCrowd(enumratorBaseThreaded):\n def __init__(self, domain, subdomains=None, q=None, silent=False, verbose=True):\n subdomains = subdomains or []\n base_url = 'https://www.threatcrowd.org/searchApi/v2/domain/report/?domain={domain}'\n self.engine_name = \"ThreatCrowd\"\n self.q = q\n super(ThreatCrowd, self).__init__(base_url, self.engine_name, domain, subdomains, q=q, silent=silent, verbose=verbose)\n return\n\n def req(self, url):\n try:\n resp = self.session.get(url, headers=self.headers, timeout=self.timeout)\n except Exception:\n resp = None\n\n return self.get_response(resp)\n\n def enumerate(self):\n url = self.base_url.format(domain=self.domain)\n resp = self.req(url)\n self.extract_domains(resp)\n return self.subdomains\n\n def extract_domains(self, resp):\n try:\n links = json.loads(resp)['subdomains']\n for link in links:\n subdomain = link.strip()\n if not subdomain.endswith(self.domain):\n continue\n if subdomain not in self.subdomains and subdomain != self.domain:\n if self.verbose:\n self.print_(\"%s%s: %s%s\" % (R, self.engine_name, W, subdomain))\n self.subdomains.append(subdomain.strip())\n except Exception as e:\n pass\n\n\nclass CrtSearch(enumratorBaseThreaded):\n def __init__(self, domain, subdomains=None, q=None, silent=False, verbose=True):\n subdomains = subdomains or []\n base_url = 'https://crt.sh/?q=%25.{domain}'\n self.engine_name = \"SSL Certificates\"\n self.q = q\n super(CrtSearch, self).__init__(base_url, self.engine_name, domain, subdomains, q=q, silent=silent, verbose=verbose)\n return\n\n def req(self, url):\n try:\n resp = self.session.get(url, headers=self.headers, timeout=self.timeout)\n except Exception:\n resp = None\n\n return self.get_response(resp)\n\n def enumerate(self):\n url = self.base_url.format(domain=self.domain)\n resp = self.req(url)\n if resp:\n self.extract_domains(resp)\n return self.subdomains\n\n def extract_domains(self, resp):\n link_regx = re.compile(' | (.*?) | ')\n try:\n links = link_regx.findall(resp)\n for link in links:\n link = link.strip()\n subdomains = []\n if '
' in link:\n subdomains = link.split('
')\n else:\n subdomains.append(link)\n\n for subdomain in subdomains:\n if not subdomain.endswith(self.domain) or '*' in subdomain:\n continue\n\n if '@' in subdomain:\n subdomain = subdomain[subdomain.find('@')+1:]\n\n if subdomain not in self.subdomains and subdomain != self.domain:\n if self.verbose:\n self.print_(\"%s%s: %s%s\" % (R, self.engine_name, W, subdomain))\n self.subdomains.append(subdomain.strip())\n except Exception as e:\n print(e)\n pass\n\nclass PassiveDNS(enumratorBaseThreaded):\n def __init__(self, domain, subdomains=None, q=None, silent=False, verbose=True):\n subdomains = subdomains or []\n base_url = 'https://api.sublist3r.com/search.php?domain={domain}'\n self.engine_name = \"PassiveDNS\"\n self.q = q\n super(PassiveDNS, self).__init__(base_url, self.engine_name, domain, subdomains, q=q, silent=silent, verbose=verbose)\n return\n\n def req(self, url):\n try:\n resp = self.session.get(url, headers=self.headers, timeout=self.timeout)\n except Exception as e:\n resp = None\n\n return self.get_response(resp)\n\n def enumerate(self):\n url = self.base_url.format(domain=self.domain)\n resp = self.req(url)\n if not resp:\n return self.subdomains\n\n self.extract_domains(resp)\n return self.subdomains\n\n def extract_domains(self, resp):\n try:\n subdomains = json.loads(resp)\n for subdomain in subdomains:\n if subdomain not in self.subdomains and subdomain != self.domain:\n if self.verbose:\n self.print_(\"%s%s: %s%s\" % (R, self.engine_name, W, subdomain))\n self.subdomains.append(subdomain.strip())\n except Exception as e:\n pass\n\n\nclass portscan():\n def __init__(self, subdomains, ports):\n self.subdomains = subdomains\n self.ports = ports\n self.lock = None\n\n def port_scan(self, host, ports):\n openports = []\n self.lock.acquire()\n for port in ports:\n try:\n s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n s.settimeout(2)\n result = s.connect_ex((host, int(port)))\n if result == 0:\n openports.append(port)\n s.close()\n except Exception:\n pass\n self.lock.release()\n if len(openports) > 0:\n print(\"%s%s%s - %sFound open ports:%s %s%s%s\" % (G, host, W, R, W, Y, ', '.join(openports), W))\n\n def run(self):\n self.lock = threading.BoundedSemaphore(value=20)\n for subdomain in self.subdomains:\n t = threading.Thread(target=self.port_scan, args=(subdomain, self.ports))\n t.start()\n\n\ndef main(domain, threads, savefile, ports, silent, verbose, enable_bruteforce, engines):\n bruteforce_list = set()\n search_list = set()\n\n if is_windows:\n subdomains_queue = list()\n else:\n subdomains_queue = multiprocessing.Manager().list()\n\n # Check Bruteforce Status\n if enable_bruteforce or enable_bruteforce is None:\n enable_bruteforce = True\n\n # Validate domain\n domain_check = re.compile(\"^(http|https)?[a-zA-Z0-9]+([\\-\\.]{1}[a-zA-Z0-9]+)*\\.[a-zA-Z]{2,}$\")\n if not domain_check.match(domain):\n if not silent:\n print(R + \"Error: Please enter a valid domain\" + W)\n return []\n\n if not domain.startswith('http://') or not domain.startswith('https://'):\n domain = 'http://' + domain\n\n parsed_domain = urlparse.urlparse(domain)\n\n if not silent:\n print(B + \"[-] Enumerating subdomains now for %s\" % parsed_domain.netloc + W)\n\n if verbose and not silent:\n print(Y + \"[-] verbosity is enabled, will show the subdomains results in realtime\" + W)\n\n supported_engines = {'baidu': BaiduEnum,\n 'yahoo': YahooEnum,\n 'google': GoogleEnum,\n 'bing': BingEnum,\n 'ask': AskEnum,\n 'netcraft': NetcraftEnum,\n 'dnsdumpster': DNSdumpster,\n 'virustotal': Virustotal,\n 'threatcrowd': ThreatCrowd,\n 'ssl': CrtSearch,\n 'passivedns': PassiveDNS\n }\n\n chosenEnums = []\n\n if engines is None:\n chosenEnums = [\n BaiduEnum, YahooEnum, GoogleEnum, BingEnum, AskEnum,\n NetcraftEnum, DNSdumpster, Virustotal, ThreatCrowd,\n CrtSearch, PassiveDNS\n ]\n else:\n engines = engines.split(',')\n for engine in engines:\n if engine.lower() in supported_engines:\n chosenEnums.append(supported_engines[engine.lower()])\n\n # Start the engines enumeration\n enums = [enum(domain, [], q=subdomains_queue, silent=silent, verbose=verbose) for enum in chosenEnums]\n for enum in enums:\n enum.start()\n for enum in enums:\n enum.join()\n\n subdomains = set(subdomains_queue)\n for subdomain in subdomains:\n search_list.add(subdomain)\n\n if enable_bruteforce:\n if not silent:\n print(G + \"[-] Starting bruteforce module now using subbrute..\" + W)\n record_type = False\n path_to_file = os.path.dirname(os.path.realpath(__file__))\n subs = os.path.join(path_to_file, 'subbrute', 'names.txt')\n resolvers = os.path.join(path_to_file, 'subbrute', 'resolvers.txt')\n process_count = threads\n output = False\n json_output = False\n bruteforce_list = subbrute.print_target(parsed_domain.netloc, record_type, subs, resolvers, process_count, output, json_output, search_list, verbose)\n\n subdomains = search_list.union(bruteforce_list)\n\n if subdomains:\n subdomains = sorted(subdomains, key=subdomain_sorting_key)\n\n if savefile:\n write_file(savefile, subdomains)\n\n if not silent:\n print(Y + \"[-] Total Unique Subdomains Found: %s\" % len(subdomains) + W)\n\n if ports:\n if not silent:\n print(G + \"[-] Start port scan now for the following ports: %s%s\" % (Y, ports) + W)\n ports = ports.split(',')\n pscan = portscan(subdomains, ports)\n pscan.run()\n\n elif not silent:\n for subdomain in subdomains:\n print(G + subdomain + W)\n return subdomains\n\n\ndef interactive():\n args = parse_args()\n domain = args.domain\n threads = args.threads\n savefile = args.output\n ports = args.ports\n enable_bruteforce = args.bruteforce\n verbose = args.verbose\n engines = args.engines\n if verbose or verbose is None:\n verbose = True\n if args.no_color:\n no_color()\n banner()\n res = main(domain, threads, savefile, ports, silent=False, verbose=verbose, enable_bruteforce=enable_bruteforce, engines=engines)\n\nif __name__ == \"__main__\":\n interactive()\n"
}
]