Skip to content

Commit 08e370f

Browse files
jiushilljiushill
authored
Add files via upload
1 parent 1863d43 commit 08e370f

6 files changed

Lines changed: 1751410 additions & 91590 deletions

File tree

‎子域名爆破/README.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
## 目标 ##
22
- [x] 子域名爆破
3-
- [ ] 接口查询
4-
- [ ] 获取网页标题
5-
- [ ] web指纹识别
3+
- [x] 接口查询
4+
- [x] 获取网页标题
5+
- [x] web指纹识别
6+
- [x] 指定端口扫描
7+
- [x] 网页截图

‎子域名爆破/baopo.py‎

Lines changed: 219 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -5,114 +5,278 @@
55
import threading
66
import os
77
import time
8+
import socket
9+
import re
10+
from selenium import webdriver
811

912
dict=[]
13+
port=[]
14+
found_domain=[]
15+
lock=threading.BoundedSemaphore(100)
1016

1117
class Rkst:
1218
def __init__(self,headers):
1319
self.headers=headers
1420

21+
def jiekou(self,url,data):
22+
try:
23+
rqt=requests.post(url=url,headers=self.headers,data=data)
24+
jso=rqt.json()['data']
25+
if len(jso)>0:
26+
for r in jso:
27+
ip=self.sok(r['domain'])
28+
title=self.title(r['domain'])
29+
op=self.port_scan(r['domain'])
30+
if '' in op:
31+
pass
32+
if '80' in op:
33+
self.jietu(url='http://{}'.format(r['domain']))
34+
elif '443' in op:
35+
self.jietu(url='https://{}'.format(r['domain']))
36+
print('[+] 查询到的域名：{} IP地址：{} {} 端口：{}'.format(r['domain'],ip,title,op))
37+
print('[+] 查询到的域名：{} IP地址：{} {} 端口：{}'.format(r['domain'],ip,title,op),file=open('save.txt','a'))
38+
else:
39+
print('[-] 无数据')
40+
except Exception as r:
41+
print('[-] 神奇的报错冒了出来：{}'.format(r))
42+
43+
lock.release()
1544
def shenc(self,file):
1645
for k in file.readlines():
1746
qc="".join(k.split('\n'))
1847
yield qc
1948

20-
def one_domain(self,ssl,url):
49+
def port_read(self,file):
50+
for p in file.readlines():
51+
qc2="".join(p.split('\n'))
52+
yield qc2
53+
54+
def one_domain(self,url):
2155
for q in dict:
22-
urls='{}'.format(ssl)+q+'.'+url
23-
yield urls
56+
urls=q+'.'+url
57+
ip=self.sok(urls)
58+
if ip:
59+
title=self.title(urls)
60+
op=self.port_scan(str(urls).replace('http://','').replace('https://',''))
61+
if '' in op:
62+
pass
63+
if '80' in op:
64+
self.jietu(url='http://{}'.format(urls))
65+
elif '443' in op:
66+
self.jietu(url='https://{}'.format(urls))
67+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls,ip,title,op))
68+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls, ip, title, op),file=open('save.txt','a'))
2469

25-
def two_domain(self,ssl,url):
70+
lock.release()
71+
def two_domain(self,url):
2672
for v in dict:
2773
for v2 in dict:
28-
urls='{}'.format(ssl)+v+'.'+v2+'.'+url
29-
yield urls
74+
urls=v+'.'+v2+'.'+url
75+
ip = self.sok(urls)
76+
if ip:
77+
title = self.title(urls)
78+
op = self.port_scan(str(urls).replace('http://', '').replace('https://', ''))
79+
if '' in op:
80+
pass
81+
if '80' in op:
82+
self.jietu(url='http://{}'.format(urls))
83+
elif '443' in op:
84+
self.jietu(url='https://{}'.format(urls))
85+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls, ip, title, op))
86+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls, ip, title, op), file=open('save.txt', 'a'))
3087

31-
def san_domain(self,ssl,url):
88+
lock.release()
89+
def san_domain(self,url):
3290
for u in dict:
3391
for u1 in dict:
3492
for u2 in dict:
35-
urls='{}'.format(ssl)+u+'.'+u1+'.'+u2+'.'+url
36-
yield urls
93+
urls=u+'.'+u1+'.'+u2+'.'+url
94+
ip = self.sok(urls)
95+
if ip:
96+
title = self.title(urls)
97+
op = self.port_scan(str(urls).replace('http://', '').replace('https://', ''))
98+
if '' in op:
99+
pass
100+
if '80' in op:
101+
self.jietu(url='http://{}'.format(urls))
102+
elif '443' in op:
103+
self.jietu(url='https://{}'.format(urls))
104+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls, ip, title, op))
105+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls, ip, title, op), file=open('save.txt', 'a'))
37106

38-
def si_domain(self,ssl,url):
107+
lock.release()
108+
def si_domain(self,url):
39109
for s in dict:
40110
for s1 in dict:
41111
for s2 in dict:
42112
for s3 in dict:
43-
urls='{}'.format(ssl)+s+'.'+s1+'.'+s2+'.'+s3+'.'+url
44-
yield urls
113+
urls=s+'.'+s1+'.'+s2+'.'+s3+'.'+url
114+
ip = self.sok(urls)
115+
if ip:
116+
title = self.title(urls)
117+
op = self.port_scan(str(urls).replace('http://', '').replace('https://', ''))
118+
if '' in op:
119+
pass
120+
if '80' in op:
121+
self.jietu(url='http://{}'.format(urls))
122+
elif '443' in op:
123+
self.jietu(url='https://{}'.format(urls))
124+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls, ip, title, op))
125+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls, ip, title, op),file=open('save.txt', 'a'))
126+
45127

46-
def wu_domain(self,ssl,url):
128+
lock.release()
129+
def wu_domain(self,url):
47130
for b in dict:
48131
for b1 in dict:
49132
for b2 in dict:
50133
for b3 in dict:
51134
for b4 in dict:
52-
urls='{}'.format(ssl)+b+'.'+b1+'.'+b2+'.'+b3+'.'+b4+'.'+url
53-
yield urls
135+
urls=b+'.'+b1+'.'+b2+'.'+b3+'.'+b4+'.'+url
136+
ip = self.sok(urls)
137+
if ip:
138+
title = self.title(urls)
139+
op = self.port_scan(str(urls).replace('http://', '').replace('https://', ''))
140+
if '' in op:
141+
pass
142+
if '80' in op:
143+
self.jietu(url='http://{}'.format(urls))
144+
elif '443' in op:
145+
self.jietu(url='https://{}'.format(urls))
146+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls, ip, title, op))
147+
print('[+] 爆破到的域名：{} IP地址：{} {} 端口：{}'.format(urls, ip, title, op),file=open('save.txt', 'a'))
148+
lock.release()
149+
def sok(self,domain):
150+
try:
151+
s=socket.getaddrinfo(domain,None)
152+
return str(s[0][4]).replace("'",'').replace('0','').replace('(','').replace(')','').replace(",",'')
153+
except:
154+
pass
54155

55-
def bao(self,url):
156+
def title(self,domain):
56157
try:
57-
reqt=requests.get(url=url,headers=self.headers,timeout=3)
58-
if reqt:
59-
print('[+] Found domain:{}'.format(url))
60-
print(url,file=open('save.txt','a'))
158+
url='http://{}'.format(domain)
159+
url2='https://{}'.format(domain)
160+
rqt=requests.get(url=url,headers=self.headers,timeout=1)
161+
if rqt:
162+
zz=re.findall('<title>.*</title>',rqt.content.decode('utf-8'))
163+
if 'Server' in rqt.headers:
164+
r=rqt.headers
165+
server=r['Server']
166+
else:
167+
server=None
168+
return '标题：{} web环境：{}'.format(str(zz[0]).replace('<title>','').replace('</title>',''),server)
169+
else:
170+
rq2=requests.get(url=url2,headers=self.headers,timeout=1)
171+
zz = re.findall('<title>.*</title>', rq2.content.decode('utf-8'))
172+
if 'Server' in rqt.headers:
173+
r=rqt.headers
174+
server=r['Server']
175+
else:
176+
server=None
177+
return '标题：{} web环境：{}'.format(str(zz[0]).replace('<title>', '').replace('</title>', ''),server)
61178
except:
179+
return None
62180
pass
63181

64-
lock.release() #Unlock the thread
182+
def port_scan(self,host):
183+
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
184+
s.settimeout(3)
185+
try:
186+
for z in port:
187+
s.connect(('{}'.format(host),int(z)))
188+
return '{}/open '.format(z)
189+
except:
190+
return ''
191+
pass
192+
193+
def jietu(self,url):
194+
brower = webdriver.Chrome()
195+
brower.get(url)
196+
brower.save_screenshot('img/{}.png'.format(str(url).replace('https://','').replace('http://','')))
197+
brower.close()
65198

66199
if __name__ == '__main__':
67200
headers={'user-agent':'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36'}
201+
jkl='http://sbd.ximcx.cn/DomainServlet'
202+
print('九世版子域名查询_何安圻')
203+
user=input('查询的域名：')
204+
print('[@] 接下来设置爆破模式，输入1为爆破一级域名，输入2为爆破二级域名，输入3位爆破三级域名，输入4为爆破四级域名，输入5位爆破5级域名，输入all为全开 注意：此模式很慢')
205+
xw=input('设置爆破模式：')
206+
data={'domain': '{}'.format(user)}
207+
obj=Rkst(headers=headers)
208+
209+
print('[*] 接口查询模式')
210+
lock.acquire()
211+
t=threading.Thread(target=obj.jiekou,args=(jkl,data))
212+
t.start()
213+
214+
68215
if os.path.exists('file/one.txt'):
69-
print('[+] Found dict.txt')
216+
print('[@] 找到了神奇的爆破字典')
217+
else:
218+
print('[-] 找不到字典= =#')
219+
print('[-] 退出程序...')
220+
exit()
221+
222+
if os.path.exists('file/port.txt'):
223+
print('[@] 找到了port.txt')
70224
else:
71-
print('[-] Not Found dict.txt...')
225+
print('[-] 找不到port.txt')
226+
print('[-] 退出程序...')
72227
exit()
73228

74229
dk=open('file/one.txt','r')
230+
for r in obj.shenc(dk):
231+
dict.append(r)
75232

76-
user=input('domain>:')
77-
ssl=input('http/https>:')
78-
obj=Rkst(headers=headers)
79-
if ssl=='http':
80-
ht='http://'
81-
elif ssl=='https':
82-
ht='https://'
233+
dk2=open('file/port.txt','r')
234+
for v in obj.port_read(dk2):
235+
port.append(v)
236+
237+
print('[*] 爆破模式')
238+
if xw=='1':
239+
lock.acquire()
240+
s=threading.Thread(target=obj.one_domain,args=(user,))
241+
s.start()
83242

84-
print('[!] Test the first level domain name')
85-
for o in obj.shenc(dk):
86-
dict.append(o)
243+
elif xw=='2':
244+
lock.acquire()
245+
s2 = threading.Thread(target=obj.two_domain, args=(user,))
246+
s2.start()
247+
248+
elif xw=='3':
249+
lock.acquire()
250+
s3 = threading.Thread(target=obj.san_domain, args=(user,))
251+
s3.start()
87252

253+
elif xw=='4':
254+
lock.acquire()
255+
s4 = threading.Thread(target=obj.si_domain, args=(user,))
256+
s4.start()
88257

89-
lock=threading.BoundedSemaphore(100) #Set the thread to 100
90-
print('[!] Write the generated first-level domain name to the list')
91-
for y in obj.one_domain(ht,user):
92-
lock.acquire() #Lock the thread
93-
t = threading.Thread(target=obj.bao, args=(y,))
94-
t.start()
258+
elif xw=='5':
259+
lock.acquire()
260+
s5 = threading.Thread(target=obj.wu_domain, args=(user,))
261+
s5.start()
262+
263+
elif xw=='all':
264+
lock.acquire()
265+
s = threading.Thread(target=obj.one_domain, args=(user,))
266+
s.start()
95267

96-
print('[!] Write the generated second-level domain name to the list')
97-
for y2 in obj.two_domain(ht,user):
98268
lock.acquire()
99-
t = threading.Thread(target=obj.bao, args=(y2,))
100-
t.start()
269+
s2 = threading.Thread(target=obj.two_domain, args=(user,))
270+
s2.start()
101271

102-
print('[!] Write the generated third-level domain name to the list')
103-
for y3 in obj.san_domain(ht,user):
104272
lock.acquire()
105-
t = threading.Thread(target=obj.bao, args=(y3,))
106-
t.start()
273+
s3 = threading.Thread(target=obj.san_domain, args=(user,))
274+
s3.start()
107275

108-
print('[!] Write the generated four-level domain name to the list')
109-
for y4 in obj.si_domain(ht,user):
110276
lock.acquire()
111-
t = threading.Thread(target=obj.bao, args=(y4,))
112-
t.start()
277+
s4 = threading.Thread(target=obj.si_domain, args=(user,))
278+
s4.start()
113279

114-
print('[!] Write the generated five-level domain name to the list')
115-
for y5 in obj.wu_domain(ht,user):
116280
lock.acquire()
117-
t = threading.Thread(target=obj.bao, args=(y5,))
118-
t.start()
281+
s5 = threading.Thread(target=obj.wu_domain, args=(user,))
282+
s5.start()

‎子域名爆破/chromedriver.exe‎

6.38 MB
Binary file not shown.

‎子域名爆破/file/demo.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
www
2+
mail

0 commit comments

Comments
 (0)