diff --git a/Pipfile b/Pipfile index 7d16102..1816d98 100644 --- a/Pipfile +++ b/Pipfile @@ -24,6 +24,7 @@ js2py = "*" tablib = "*" brotli = "*" psutil = "*" +tenacity = "*" [requires] python_version = "3.8" diff --git a/Pipfile.lock b/Pipfile.lock index 044dba7..6139a85 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -1,7 +1,7 @@ { "_meta": { "hash": { - "sha256": "a2f11736ad9a177433ceec37cc0461993824b6d175f5a11f4193a2a05ee40ce1" + "sha256": "80401fb48ed5ae18b53fd9283b236ccf9f40f324624b0d191a5e2eebb80c23db" }, "pipfile-spec": 6, "requires": { @@ -57,11 +57,11 @@ }, "beautifulsoup4": { "hashes": [ - "sha256:05fd825eb01c290877657a56df4c6e4c311b3965bda790c613a3d6fb01a5462a", - "sha256:9fbb4d6e48ecd30bcacc5b63b94088192dcda178513b2ae3c394229f8911b887", - "sha256:e1505eeed31b0f4ce2dbb3bc8eb256c04cc2b3b72af7d551a4ab6efd5cbe5dae" + "sha256:594ca51a10d2b3443cbac41214e12dbb2a1cd57e1a7344659849e2e20ba6a8d8", + "sha256:a4bbe77fd30670455c5296242967a123ec28c37e9702a8a81bd2f20a4baf0368", + "sha256:d4e96ac9b0c3a6d3f0caae2e4124e6055c5dcafde8e2f831ff194c104f0775a0" ], - "version": "==4.8.2" + "version": "==4.9.0" }, "brotli": { "hashes": [ @@ -83,11 +83,11 @@ "sha256:9d1c2dd27a1083fefd05b1b2f8df4a6bc2aaa6c21dd82cd41c8ae5e7c23a87f8", "sha256:a13ce9b419fe9f277c63f700efb0e444331509d1881b5610d2ba7e9080606967", "sha256:a19ef0952b9d2803df88dff07f45a6c92d5676afb9b8d69cf32232d684036d11", - "sha256:a44d41e7a80cc832f04f4c1577a67bd311e28a6e40702a258590d8949a204d9d", "sha256:ad766ca8b8c1419b71a22756b45264f45725c86133dc80a7cbe30b6b78c75620", "sha256:ad7963f261988ee0883816b6b9f206f11461c9b3cb5cfbca0c9ab5adc406d395", "sha256:af0451e23016631a2f52925a10d738ac4a0f794ac315c30380b22efc0c90cbc6", "sha256:c16201060c5a3f8742e3deae759014251ac92f382f82bc2a41dc079ff18c3f24", + "sha256:c43b202f65891861a9a336984a103de25de235f756de69e32db893156f767013", "sha256:c675c6cce4295cb1a692f3de7416aacace7314e064b94bc86e93aceefce7fd3e", "sha256:d17cec0b992b1434f5f9df9986563605a4d1b1acd5574c87fc2ac014bcbd3316", "sha256:dc91f6129953861a73d9a65c52a8dd682b561a9ebaf65283541645cab6489917", @@ -111,10 +111,10 @@ }, "certifi": { "hashes": [ - "sha256:017c25db2a153ce562900032d5bc68e9f191e44e9a0f762f373977de9df1fbb3", - "sha256:25b64c7da4cd7479594d035c08c2d809eb4aab3a26e5a990ea98cc450c320f1f" + "sha256:1d987a998c75633c40847cc966fcf5904906c920a7f17ef374f5aa4282abd304", + "sha256:51fcb31174be6e6664c5f69e3e1691a2d72a1a12e90f872cbdb1567eb47b6519" ], - "version": "==2019.11.28" + "version": "==2020.4.5.1" }, "chardet": { "hashes": [ @@ -125,11 +125,11 @@ }, "cloudscraper": { "hashes": [ - "sha256:7a843769aaed50905afeff82c3ebdd1a3a5980bfa5436719f05f0db4af127790", - "sha256:ebeb5f9adcb52ed6b763688b05c34264942116b01f8f0b7a5b7de7c1d505cd67" + "sha256:2bcd017740c7dc0b8d64b55742638a50960ba82b9fd75fc38b9e94c5cd641aa5", + "sha256:74618cfd55841dd0df959a164ee30b9456ecaddcbc7215cc13f89e7a0e3cadf0" ], "index": "pypi", - "version": "==1.2.28" + "version": "==1.2.33" }, "colorama": { "hashes": [ @@ -168,10 +168,10 @@ }, "fire": { "hashes": [ - "sha256:6865fefc6981a713d2ce56a2a2c92c56c729269f74a6cddd6f4b94d16ae084c9" + "sha256:9736a16227c3d469e5d2d296bce5b4d8fa8d7851e953bda327a455fc2994307f" ], "index": "pypi", - "version": "==0.2.1" + "version": "==0.3.1" }, "idna": { "hashes": [ @@ -189,11 +189,11 @@ }, "js2py": { "hashes": [ - "sha256:306ba83c8ce16b330e532bfe2870763d0a4bbf4d6aab07799ea3c8c1446e1275", - "sha256:80f333d8c654396370974956b37679c1d45cfd4efdcf9731122e1fc809f7a67e" + "sha256:7568b33f6bd15ee8ab1f3655928ed05481a6236ad2acca4598703ae501571661", + "sha256:f78e76c88942585973129a0a10e7054b5ea1602d761d4c0ccfa0593bc819f0bb" ], "index": "pypi", - "version": "==0.68" + "version": "==0.70" }, "loguru": { "hashes": [ @@ -350,10 +350,28 @@ }, "sqlalchemy": { "hashes": [ - "sha256:c4cca4aed606297afbe90d4306b49ad3a4cd36feb3f87e4bfd655c57fd9ef445" + "sha256:083e383a1dca8384d0ea6378bd182d83c600ed4ff4ec8247d3b2442cf70db1ad", + "sha256:0a690a6486658d03cc6a73536d46e796b6570ac1f8a7ec133f9e28c448b69828", + "sha256:114b6ace30001f056e944cebd46daef38fdb41ebb98f5e5940241a03ed6cad43", + "sha256:128f6179325f7597a46403dde0bf148478f868df44841348dfc8d158e00db1f9", + "sha256:13d48cd8b925b6893a4e59b2dfb3e59a5204fd8c98289aad353af78bd214db49", + "sha256:211a1ce7e825f7142121144bac76f53ac28b12172716a710f4bf3eab477e730b", + "sha256:2dc57ee80b76813759cccd1a7affedf9c4dbe5b065a91fb6092c9d8151d66078", + "sha256:3e625e283eecc15aee5b1ef77203bfb542563fa4a9aa622c7643c7b55438ff49", + "sha256:43078c7ec0457387c79b8d52fff90a7ad352ca4c7aa841c366238c3e2cf52fdf", + "sha256:5b1bf3c2c2dca738235ce08079783ef04f1a7fc5b21cf24adaae77f2da4e73c3", + "sha256:6056b671aeda3fc451382e52ab8a753c0d5f66ef2a5ccc8fa5ba7abd20988b4d", + "sha256:68d78cf4a9dfade2e6cf57c4be19f7b82ed66e67dacf93b32bb390c9bed12749", + "sha256:7025c639ce7e170db845e94006cf5f404e243e6fc00d6c86fa19e8ad8d411880", + "sha256:7224e126c00b8178dfd227bc337ba5e754b197a3867d33b9f30dc0208f773d70", + "sha256:7d98e0785c4cd7ae30b4a451416db71f5724a1839025544b4edbd92e00b91f0f", + "sha256:8d8c21e9d4efef01351bf28513648ceb988031be4159745a7ad1b3e28c8ff68a", + "sha256:bbb545da054e6297242a1bb1ba88e7a8ffb679f518258d66798ec712b82e4e07", + "sha256:d00b393f05dbd4ecd65c989b7f5a81110eae4baea7a6a4cdd94c20a908d1456e", + "sha256:e18752cecaef61031252ca72031d4d6247b3212ebb84748fc5d1a0d2029c23ea" ], "markers": "python_version >= '3.0'", - "version": "==1.3.15" + "version": "==1.3.16" }, "tablib": { "hashes": [ @@ -363,6 +381,14 @@ "index": "pypi", "version": "==1.1.0" }, + "tenacity": { + "hashes": [ + "sha256:f7bcbf5bb53875cfc38f61f596a88b1c994af32420f120c4409542a683ad613b", + "sha256:fb01d8ef2474eed422d8314a566c9e391cccb6e50cf4585022add6cb5cda66c8" + ], + "index": "pypi", + "version": "==6.1.0" + }, "termcolor": { "hashes": [ "sha256:1d6d69ce66211143803fbc56652b41d73b4a400a2891d7bf7a1cdf4c02de613b" @@ -379,11 +405,11 @@ }, "tqdm": { "hashes": [ - "sha256:0d8b5afb66e23d80433102e9bd8b5c8b65d34c2a2255b2de58d97bd2ea8170fd", - "sha256:f35fb121bafa030bd94e74fcfd44f3c2830039a2ddef7fc87ef1c2d205237b24" + "sha256:00339634a22c10a7a22476ee946bbde2dbe48d042ded784e4d88e0236eca5d81", + "sha256:ea9e3fd6bd9a37e8783d75bfc4c1faf3c6813da6bd1c3e776488b41ec683af94" ], "index": "pypi", - "version": "==4.43.0" + "version": "==4.45.0" }, "tzlocal": { "hashes": [ @@ -394,10 +420,10 @@ }, "urllib3": { "hashes": [ - "sha256:2f3db8b19923a873b3e5256dc9c2dedfa883e33d87c690d9c7913e1f40673cdc", - "sha256:87716c2d2a7121198ebcb7ce7cccf6ce5e9ba539041cfbaeecfb641dc0bf6acc" + "sha256:3018294ebefce6572a474f0604c2021e33b3fd8006ecd11d62107a5d2a963527", + "sha256:88206b0eb87e6d677d424843ac5209e3fb9d0190d0ee169599165ec25e9d9115" ], - "version": "==1.25.8" + "version": "==1.25.9" }, "win32-setctime": { "hashes": [ diff --git a/oneforall/brute.py b/oneforall/brute.py index b7a0734..1652474 100644 --- a/oneforall/brute.py +++ b/oneforall/brute.py @@ -10,8 +10,6 @@ OneForAll子域爆破模块 import json import time import stat -import queue -import asyncio import random import secrets import platform @@ -19,15 +17,18 @@ import subprocess import exrex import fire +from tenacity import TryAgain, retry, stop_after_attempt +from dns.exception import Timeout +from dns.resolver import Answer import config import dbexport from common import resolve, utils from common.module import Module -from common.database import Database from config import logger +@retry(stop=stop_after_attempt(3)) def detect_wildcard(domain): """ 探测域名是否使用泛解析 @@ -42,17 +43,23 @@ def detect_wildcard(domain): try: answer = resolver.query(random_subdomain, 'A') # 如果查询随机域名A记录出错 说明不存在随机子域的A记录 即没有开启泛解析 + except Timeout as e: + logger.log('ALERT', f'探测超时将重新探测') + logger.log('DEBUG', e.args) + raise TryAgain except Exception as e: logger.log('DEBUG', e.args) logger.log('INFOR', f'{domain}没有使用泛解析') return False - ttl = answer.ttl - name = answer.name - ips = {item.address for item in answer} - logger.log('ALERT', f'{domain}使用了泛解析') - logger.log('ALERT', f'{random_subdomain} 解析到域名: {name} ' - f'IP: {ips} TTL: {ttl}') - return True + if isinstance(answer, Answer): + ttl = answer.ttl + name = answer.name + ips = {item.address for item in answer} + logger.log('ALERT', f'{domain}使用了泛解析') + logger.log('ALERT', f'{random_subdomain} 解析到域名: {name} ' + f'IP: {ips} TTL: {ttl}') + return True + return False def gen_fuzz_subdomains(expression, rule): diff --git a/requirements.txt b/requirements.txt index 900d0d8..601f255 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,21 +2,21 @@ aiohttp==3.6.2 aiomultiprocess==0.7.0 async-timeout==3.0.1 attrs==19.3.0 -beautifulsoup4==4.8.2 +beautifulsoup4==4.9.0 Brotli==1.0.7 bs4==0.0.1 -certifi==2019.11.28 +certifi==2020.4.5.1 chardet==3.0.4 -cloudscraper==1.2.28 +cloudscraper==1.2.33 colorama==0.4.3 dnspython==1.16.0 docopt==0.6.2 et-xmlfile==1.0.1 exrex==0.10.5 -fire==0.2.1 +fire==0.3.1 idna==2.9 jdcal==1.4.1 -Js2Py==0.68 +Js2Py==0.70 loguru==0.4.1 lxml==4.5.0 multidict==4.7.5 @@ -31,12 +31,13 @@ requests-file==1.4.3 requests-toolbelt==0.9.1 six==1.14.0 soupsieve==2.0 -SQLAlchemy==1.3.15 +SQLAlchemy==1.3.16 tablib==1.1.0 +tenacity==6.1.0 termcolor==1.1.0 tldextract==2.2.2 -tqdm==4.43.0 +tqdm==4.45.0 tzlocal==2.0.0 -urllib3==1.25.8 +urllib3==1.25.9 win32-setctime==1.0.1 yarl==1.4.2 \ No newline at end of file