From 0d366a872dfe7dfe370a08c479363280d8e657b8 Mon Sep 17 00:00:00 2001 From: Jing Ling Date: Thu, 19 Nov 2020 02:21:44 +0800 Subject: [PATCH] =?UTF-8?q?=E9=BB=98=E8=AE=A4=E5=90=AF=E7=94=A8=E5=AD=90?= =?UTF-8?q?=E5=9F=9F=E7=BD=AE=E6=8D=A2=E5=8A=9F=E8=83=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- config/default.py | 2 +- modules/altdns.py | 23 ++++++++++++++++++----- 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/config/default.py b/config/default.py index efe149b..c1a8398 100644 --- a/config/default.py +++ b/config/default.py @@ -23,7 +23,7 @@ enable_brute_module = True # 使用爆破模块(默认True) enable_dns_resolve = True # 使用DNS解析子域(默认True) enable_http_request = True # 使用HTTP请求子域(默认True) enable_finder_module = True # 开启finder模块,开启会从响应体和JS中再次发现子域(默认True) -enable_altdns_module = False # 开启altdns模块,开启会利用置换技术重组子域再次发现新子域(默认True) +enable_altdns_module = True # 开启altdns模块,开启会利用置换技术重组子域再次发现新子域(默认True) enable_enrich_module = True # 开启enrich模块，开启会富化出信息，如ip的cdn，cidr，asn，org，addr和isp等信息 enable_banner_identify = True # 开启WEB指纹识别模块(默认True) enable_takeover_check = False # 开启子域接管风险检查(默认False) diff --git a/modules/altdns.py b/modules/altdns.py index 4531136..6890a53 100644 --- a/modules/altdns.py +++ b/modules/altdns.py @@ -7,6 +7,7 @@ import itertools from config import settings +from modules import wildcard from common import utils from common import resolve from common import request @@ -75,14 +76,16 @@ class Altdns(Module): # test1.example.com -> test2.example.com, test3.example.com, ... # test01.example.com -> test02.example.com, test03.example.com, ... + count = 0 digits = re.findall(r'\d{1,3}', subname) - for d in digits: for m in range(self.num_count): replacement = str(int(d) + 1 + m).zfill(len(d)) tmp_domain = subname.replace(d, replacement) new_domain = f'{tmp_domain}.{self.domain}' self.new_subdomains.add(new_domain) + count += 1 + logger.log('DEBUG', f'The increase_num generated {count} subdomains') def decrease_num(self, subname): """ @@ -94,8 +97,8 @@ class Altdns(Module): # test4.example.com -> test3.example.com, test2.example.com, ... # test04.example.com -> test03.example.com, test02.example.com, ... + count = 0 digits = re.findall(r'\d{1,3}', subname) - for d in digits: for m in range(self.num_count): new_digit = (int(d) - 1 - m) @@ -106,6 +109,8 @@ class Altdns(Module): tmp_domain = subname.replace(d, replacement) new_domain = f'{tmp_domain}.{self.domain}' self.new_subdomains.add(new_domain) + count += 1 + logger.log('DEBUG', f'The decrease_num generated {count} subdomains') def insert_word(self, parts): """ @@ -118,12 +123,15 @@ class Altdns(Module): # test.1.foo.WORD.example.com, # ... + count = 0 for word in self.words: for index in range(len(parts)): tmp_parts = parts.copy() tmp_parts.insert(index, word) new_domain = '.'.join(tmp_parts) self.new_subdomains.add(new_domain) + count += 1 + logger.log('DEBUG', f'The insert_word generated {count} subdomains') def add_word(self, subnames): """ @@ -131,6 +139,7 @@ class Altdns(Module): append existing content with `-WORD` """ + count = 0 for word in self.words: for index, name in enumerate(subnames): # Prepend with `-` @@ -146,6 +155,8 @@ class Altdns(Module): tmp_subnames[index] = f'{name}-{word}' new_subname = '.'.join(tmp_subnames + [self.domain]) self.new_subdomains.add(new_subname) + count += 1 + logger.log('DEBUG', f'The add_word generated {count} subdomains') def replace_word(self, subname): """ @@ -158,6 +169,7 @@ class Altdns(Module): # WORD4.1.foo.example.com, # .. + count = 0 for word in self.words: if word not in subname: continue @@ -167,6 +179,8 @@ class Altdns(Module): new_subname = subname.replace(word, word_alt) new_subdomain = f'{new_subname}.{self.domain}' self.new_subdomains.add(new_subdomain) + count += 1 + logger.log('DEBUG', f'The replace_word generated {count} subdomains') def gen_new_subdomains(self): for subdomain in self.now_subdomains: @@ -194,6 +208,5 @@ class Altdns(Module): self.elapse = round(self.end - self.start, 1) self.gen_result() resolved_data = resolve.run_resolve(self.domain, self.results) - request.run_request(self.domain, resolved_data, port) - logger.log('INFOR', f'Saving altdns results') - utils.save_to_db(self.domain, data, 'altdns') + valid_data = wildcard.deal_wildcard(resolved_data) # 强制开启泛解析处理 + request.run_request(self.domain, valid_data, port)