river_tao/OneForAll-mirror
1
0
Fork 0
mirror of https://github.com/shmilylty/OneForAll.git synced 2026-08-25 20:37:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

add cname blacklist

Browse Source
This commit is contained in:
cuijianxiong
2020-10-19 15:15:50 +08:00
parent 90477b336f
commit 10cdfdffb8
2 changed files with 13 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
brute.py
+10 -7
View File
@@ -375,7 +375,7 @@ def check_dict():
exit(0)
def gen_result_infos(items, infos, subdomains, ip_times, wc_ips, wc_ttl):
def gen_result_infos(items, infos, subdomains, ip_times, wc_ips, wc_ttl, bk_cname):
qname = items.get('name')[:-1] # 去除最右边的`.`点号
reason = items.get('status')
resolver = items.get('resolver')
@@ -403,7 +403,7 @@ def gen_result_infos(items, infos, subdomains, ip_times, wc_ips, wc_ttl):
public.append(utils.ip_is_public(ip))
num = ip_times.get(ip)
times.append(num)
isvalid, reason = is_valid_subdomain(ip, ttl, num, wc_ips, wc_ttl)
isvalid, reason = is_valid_subdomain(ip, ttl, num, wc_ips, wc_ttl, cname, bk_cname)
logger.log('TRACE', f'{ip} effective: {isvalid} reason: {reason}')
is_valid_flags.append(isvalid)
if not have_a_record:
@@ -454,7 +454,7 @@ def stat_ip_times(result_paths):
return times
def deal_output(output_paths, ip_times, wildcard_ips, wildcard_ttl):
def deal_output(output_paths, ip_times, wildcard_ips, wildcard_ttl, bk_cname):
logger.log('INFOR', f'Processing result')
infos = dict() # 用来记录所有域名有关信息
subdomains = list() # 用来保存所有通过有效性检查的子域
@@ -481,7 +481,7 @@ def deal_output(output_paths, ip_times, wildcard_ips, wildcard_ttl):
continue
infos, subdomains = gen_result_infos(items, infos, subdomains,
ip_times, wildcard_ips,
wildcard_ttl)
wildcard_ttl, bk_cname)
return infos, subdomains
@@ -515,8 +515,10 @@ def check_ip_times(times):
return False
def is_valid_subdomain(ip, ttl, times, wc_ips, wc_ttl):
def is_valid_subdomain(ip, ttl, times, wc_ips, wc_ttl, cname, bk_cname):
ip_blacklist = settings.brute_ip_blacklist
if cname in bk_cname:
return 0, 'cname blacklist' # 有些泛解析会统一解析到一个cname上
if ip in ip_blacklist: # 解析ip在黑名单ip则为非法子域
return 0, 'IP blacklist'
if all([wc_ips, wc_ttl]): # 有泛解析记录才进行对比
@@ -581,10 +583,11 @@ class Brute(Module):
def __init__(self, target=None, targets=None, process=None, concurrent=None,
word=False, wordlist=None, recursive=False, depth=None, nextlist=None,
fuzz=False, place=None, rule=None, fuzzlist=None, export=True,
alive=True, format='csv', path=None):
alive=True, format='csv', path=None, bk_cname=[]):
Module.__init__(self)
self.module = 'Brute'
self.source = 'Brute'
self.bk_cname = bk_cname
self.target = target
self.targets = targets
self.process_num = process or utils.get_process_num()
@@ -713,7 +716,7 @@ class Brute(Module):
output_paths.append(output_path)
ip_times = stat_ip_times(output_paths)
self.infos, self.subdomains = deal_output(output_paths, ip_times,
wildcard_ips, wildcard_ttl)
wildcard_ips, wildcard_ttl, self.bk_cname)
delete_file(dict_path, output_paths)
end = time.time()
self.elapse = round(end - start, 1)
oneforall.py
+3 -2
View File
@@ -83,10 +83,11 @@ class OneForAll(object):
:param bool takeover: Scan subdomain takeover (default False)
"""
def __init__(self, target=None, targets=None, brute=None, dns=None, req=None,
port=None, alive=None, format=None, path=None, takeover=None):
port=None, alive=None, format=None, path=None, takeover=None, bk_cname=[]):
self.target = target
self.targets = targets
self.brute = brute
self.bk_cname = bk_cname
self.dns = dns
self.req = req
self.port = port
@@ -197,7 +198,7 @@ class OneForAll(object):
if self.brute:
# Due to there will be a large number of dns resolution requests,
# may cause other network tasks to be error
brute = Brute(self.domain, word=True, export=False)
brute = Brute(self.domain, word=True, export=False, bk_cname=self.bk_cname)
brute.check_env = False
brute.quite = True
brute.run()