river_tao/OneForAll-mirror
1
0
Fork 0
mirror of https://github.com/shmilylty/OneForAll.git synced 2026-08-26 12:57:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

更新文档

Browse Source
This commit is contained in:
Jing Ling
2020-08-25 00:28:03 +08:00
parent 6ba4e2ed60
commit 20019fc9f7
6 changed files with 261 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files
brute.py
+2 -3
View File
@@ -533,14 +533,13 @@ class Brute(Module):
Example： Example：
brute.py --target domain.com --word True run brute.py --target domain.com --word True run
brute.py --targets ./domains.txt --word True run brute.py --targets ./domains.txt --word True run
brute.py --target domain.com --word True --process 1 run brute.py --target domain.com --word True --concurrent 2000 run
brute.py --target domain.com --word True --wordlist subnames.txt run brute.py --target domain.com --word True --wordlist subnames.txt run
brute.py --target domain.com --word True --recursive True --depth 2 run brute.py --target domain.com --word True --recursive True --depth 2 run
brute.py --target d.com --fuzz True --place m.*.d.com --rule '[a-z]' run brute.py --target d.com --fuzz True --place m.*.d.com --rule '[a-z]' run
brute.py --target d.com --fuzz True --place m.*.d.com --fuzzlist subnames.txt run brute.py --target d.com --fuzz True --place m.*.d.com --fuzzlist subnames.txt run
Note: Note:
--alive True/False Only export alive subdomains or not (default False)
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format) --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
--path Result path (default None, automatically generated) --path Result path (default None, automatically generated)
@@ -548,7 +547,7 @@ class Brute(Module):
:param str target: One domain (target or targets must be provided) :param str target: One domain (target or targets must be provided)
:param str targets: File path of one domain per line :param str targets: File path of one domain per line
:param int process: Number of processes (default 1) :param int process: Number of processes (default 1)
:param int concurrent: Number of concurrent (default 10000) :param int concurrent: Number of concurrent (default 2000)
:param bool word: Use word mode generate dictionary (default False) :param bool word: Use word mode generate dictionary (default False)
:param str wordlist: Dictionary path used in word mode (default use ./config/default.py) :param str wordlist: Dictionary path used in word mode (default use ./config/default.py)
:param bool recursive: Use recursion (default False) :param bool recursive: Use recursion (default False)
dbexport.py
-2
View File
@@ -29,7 +29,6 @@ def export(target, type='target', db=None, alive=False, limit=None, path=None, f
python3 dbexport.py --target table_name --tb True --show False python3 dbexport.py --target table_name --tb True --show False
Note: Note:
--alive True/False Only export alive subdomains or not (default False)
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format) --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
--path Result directory (default directory is ./results) --path Result directory (default directory is ./results)
@@ -82,4 +81,3 @@ def export(target, type='target', db=None, alive=False, limit=None, path=None, f
if __name__ == '__main__': if __name__ == '__main__':
fire.Fire(export) fire.Fire(export)
# export('example.com')
docs/en-us/usage_help.md
+188 -115
View File
@@ -10,141 +10,214 @@ The OneForAll command line interface is based on [Fire](https://github.com/googl
1. **oneforall.py help** 1. **oneforall.py help**
```bash ```bash
python oneforall.py --help python oneforall.py --help
``` ```
```bash ```bash
NAME NAME
oneforall.py - OneForAll help summary page oneforall.py - OneForAll help summary page
SYNOPSIS SYNOPSIS
oneforall.py COMMAND | <flags> oneforall.py COMMAND | <flags>
DESCRIPTION DESCRIPTION
OneForAll is a powerful subdomain integration tool OneForAll is a powerful subdomain integration tool
Example: Example:
python3 oneforall.py version python3 oneforall.py version
python3 oneforall.py check python3 oneforall.py check
python3 oneforall.py --target example.com run python3 oneforall.py --target example.com run
python3 oneforall.py --targets ./domains.txt run python3 oneforall.py --targets ./domains.txt run
python3 oneforall.py --target example.com --alive False run python3 oneforall.py --target example.com --alive False run
python3 oneforall.py --target example.com --brute True run python3 oneforall.py --target example.com --brute True run
python3 oneforall.py --target example.com --port medium run python3 oneforall.py --target example.com --port medium run
python3 oneforall.py --target example.com --format csv run python3 oneforall.py --target example.com --format csv run
python3 oneforall.py --target example.com --dns False run python3 oneforall.py --target example.com --dns False run
python3 oneforall.py --target example.com --req False run python3 oneforall.py --target example.com --req False run
python3 oneforall.py --target example.com --takeover False run python3 oneforall.py --target example.com --takeover False run
python3 oneforall.py --target example.com --show True run python3 oneforall.py --target example.com --show True run
Note: Note:
--alive True/False Only export alive subdomains or not (default False) --port small/medium/large See details in ./config/setting.py(default small)
--port small/medium/large See details in ./config/setting.py(default small) --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format) --path Result path (default None, automatically generated)
--path Result path (default None, automatically generated)
FLAGS FLAGS
--target=TARGET --target=TARGET
One domain (target or targets parameters must be provided) One domain (target or targets parameters must be provided)
--targets=TARGETS --targets=TARGETS
File path of one domain per line File path of one domain per line
--brute=BRUTE --brute=BRUTE
Use brute module (default False) Use brute module (default False)
--dns=DNS --dns=DNS
Use DNS resolution (default True) Use DNS resolution (default True)
--req=REQ --req=REQ
HTTP request subdomains (default True) HTTP request subdomains (default True)
--port=PORT --port=PORT
The port range to request (default small port is 80,443) The port range to request (default small port is 80,443)
--alive=ALIVE --alive=ALIVE
Only export alive subdomains (default False) Only export alive subdomains (default False)
--format=FORMAT --format=FORMAT
Result format (default csv) Result format (default csv)
--path=PATH --path=PATH
Result path (default None, automatically generated) Result path (default None, automatically generated)
--takeover=TAKEOVER --takeover=TAKEOVER
Scan subdomain takeover (default False) Scan subdomain takeover (default False)
COMMANDS COMMANDS
COMMAND is one of the following: COMMAND is one of the following:
check check
Check if there is a new version and exit Check if there is a new version and exit
version version
Print version information and exit Print version information and exit
``` ```
2. **aiobrute.py help** 2. **aiobrute.py help**
With regard to the handling of the universal parsing problem, first of all, OneForAll accesses a random subdomain to determine whether universal parsing is used, and if universal parsing is used, it is handled by the following judgment: With regard to the handling of the universal parsing problem, first of all, OneForAll accesses a random subdomain to determine whether universal parsing is used, and if universal parsing is used, it is handled by the following judgment:
- First, it is mainly compared with the pan-parsed IP set and TTL values, see [this article](http://sh3ll.me/archives/201704041222.txt). - First, it is mainly compared with the pan-parsed IP set and TTL values, see [this article](http://sh3ll.me/archives/201704041222.txt).
- Second, the number of times to resolve to the same IP collection multiple times (the default is 10, which can be set to size in config.py). - Second, the number of times to resolve to the same IP collection multiple times (the default is 10, which can be set to size in config.py).
- Third, considering the blasting efficiency, there is no HTTP response volume similarity comparison and response volume content judgment, this function has not been implemented yet, and will be implemented if necessary. - Third, considering the blasting efficiency, there is no HTTP response volume similarity comparison and response volume content judgment, this function has not been implemented yet, and will be implemented if necessary.
```bash ```bash
python aiobrute.py --help python brute.py --help
``` ```
```bash ```bash
NAME NAME
aiobrute.py - OneForAll multi-process multi-correlation asynchronous subdomain blasting module brute.py - OneForAll subdomain brute module
SYNOPSIS SYNOPSIS
aiobrute.py --target=TARGET <flags> brute.py <flags>
DESCRIPTION DESCRIPTION
Example： Example：
python3 aiobrute.py --target example.com run brute.py --target domain.com --word True run
python3 aiobrute.py --target ./domains.txt run brute.py --targets ./domains.txt --word True run
python3 aiobrute.py --target example.com --process 4 --coroutine 64 run brute.py --target domain.com --word True --concurrent 2000 run
python3 aiobrute.py --target example.com --wordlist subdomains.txt run brute.py --target domain.com --word True --wordlist subnames.txt run
python3 aiobrute.py --target example.com --recursive True --depth 2 run brute.py --target domain.com --word True --recursive True --depth 2 run
python3 aiobrute.py --target m.{fuzz}.a.bz --fuzz True --rule [a-z] run brute.py --target d.com --fuzz True --place m.*.d.com --rule '[a-z]' run
brute.py --target d.com --fuzz True --place m.*.d.com --fuzzlist subnames.txt run
Note: Note:
Parameter valid optional value 1, 0, none indicates that the export is --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
valid, invalid, and all subdomains, respectively. --path Result path (default None, automatically generated)
Parameter format have optional values 'txt', 'rst', 'csv', 'tsv', 'json', FLAGS
'yaml', 'html', 'jira', 'xls', 'xlsx', 'dbf', 'latex', 'ods'. --target=TARGET
If the parameter path is None, the appropriate file is generated in the One domain (target or targets must be provided)
project result directory based on the format parameter and the domain --targets=TARGETS
name. File path of one domain per line
--process=PROCESS
Number of processes (default 1)
--concurrent=CONCURRENT
Number of concurrent (default 2000)
--word=WORD
Use word mode generate dictionary (default False)
--wordlist=WORDLIST
Dictionary path used in word mode (default use ./config/default.py)
--recursive=RECURSIVE
Use recursion (default False)
--depth=DEPTH
Recursive depth (default 2)
--nextlist=NEXTLIST
Dictionary file path used by recursive (default use ./config/default.py)
--fuzz=FUZZ
Use fuzz mode generate dictionary (default False)
--place=PLACE
Designated fuzz position (required if use fuzz mode)
--rule=RULE
Specify the regexp rules used in fuzz mode (required if use fuzz mode)
--fuzzlist=FUZZLIST
Dictionary path used in fuzz mode (default use ./config/default.py)
--export=EXPORT
Export the results (default True)
--alive=ALIVE
Only export alive subdomains (default False)
--format=FORMAT
Result format (default csv)
--path=PATH
Result directory (default None)
```
ARGUMENTS 3. **takeover.py help**
TARGET
Single domain name or file path for one domain name per line (required)
FLAGS ```bash
--process=PROCESS python takeover.py --help
Number of processes blasted (default CPU core count) ```
--coroutine=COROUTINE
Number of coroutines per blasting process (default 1024) ```bash
--wordlist=WORDLIST NAME
Specify the dictionary path used for blasting (config.py is used by default) takeover.py - OneForAll subdomain takeover module SYNOPSIS takeover.py <flags> DESCRIPTION
--recursive=RECURSIVE
Whether to use recursive blasting (default False) Example:
--depth=DEPTH python3 takeover.py --target www.example.com --format csv run
Depth of recursive blasting (default 2) python3 takeover.py --targets ./subdomains.txt --thread 10 run
--namelist=NAMELIST
Specifies the dictionary path used by recursive blasting (configured by default using config.py) Note:
--fuzz=FUZZ --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
Whether to use the fuzz mode for blasting (default False, you must specify the fuzz regular rule) --path Result directory (default directory is ./results)
--rule=RULE
Regular rules used by fuzz mode (configured by default using config.py) FLAGS
--export=EXPORT --target=TARGET
Whether to export the blast result (default True) One domain (target or targets must be provided)
--valid=VALID --targets=TARGETS
Export validity of subdomains (default None) File path of one domain per line
--format=FORMAT --thread=THREAD
Export format (default xls) threads number (default 20)
--path=PATH --path=PATH
Export path (default None) Result directory (default None)
--show=SHOW --format=FORMAT
Terminal display exported data (default False) Result format (default csv)
``` ```
4. **dbexport.py help**
```bash
python dbexport.py --help
```
```bash
NAME
dbexport.py - OneForAll export from database module
SYNOPSIS
dbexport.py TARGET <flags>
DESCRIPTION
Example:
python3 dbexport.py --target name --format csv --dir= ./result.csv
python3 dbexport.py --db result.db --target name --show False
python3 dbexport.py --target table_name --tb True --show False
Note:
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
--path Result directory (default directory is ./results)
POSITIONAL ARGUMENTS
TARGET
Table to be exported
FLAGS
--type=TYPE
Type of target
--db=DB
Database path to be exported (default ./results/result.sqlite3)
--alive=ALIVE
Only export the results of alive subdomains (default False)
--limit=LIMIT
Export limit (default None)
--path=PATH
Result directory (default None)
--format=FORMAT
Result format (default csv)
--show=SHOW
Displays the exported data in terminal (default False)
```
docs/usage_help.md
+53 -59
View File
@@ -38,7 +38,6 @@ OneForAll命令行界面基于[Fire](https://github.com/google/python-fire/)实
python3 oneforall.py --target example.com --show True run python3 oneforall.py --target example.com --show True run
Note: Note:
--alive True/False 只导出存活子域(默认False)
--port small/medium/large 详见./config/setting.py(默认small) --port small/medium/large 详见./config/setting.py(默认small)
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (结果格式，默认CSV) --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (结果格式，默认CSV)
--path 结果路径(默认None，自动生成) --path 结果路径(默认None，自动生成)
@@ -90,63 +89,56 @@ OneForAll命令行界面基于[Fire](https://github.com/google/python-fire/)实
```bash ```bash
NAME NAME
aiobrute.py - OneForAll多进程多协程异步子域爆破模块 brute.py - OneForAll子域爆破模块
SYNOPSIS SYNOPSIS
aiobrute.py --target=TARGET <flags> brute.py <flags>
DESCRIPTION DESCRIPTION
Example： Example：
python3 aiobrute.py --target example.com run brute.py --target domain.com --word True run
python3 aiobrute.py --target ./domains.txt run brute.py --targets ./domains.txt --word True run
python3 aiobrute.py --target example.com --process 4 --coroutine 64 run brute.py --target domain.com --word True --coroutine 2000 run
python3 aiobrute.py --target example.com --wordlist subdomains.txt run brute.py --target domain.com --word True --wordlist subnames.txt run
python3 aiobrute.py --target example.com --recursive True --depth 2 run brute.py --target domain.com --word True --recursive True --depth 2 run
python3 aiobrute.py --target m.{fuzz}.a.bz --fuzz True --rule [a-z] run brute.py --target d.com --fuzz True --place m.*.d.com --rule '[a-z]' run
brute.py --target d.com --fuzz True --place m.*.d.com --fuzzlist subnames.txt run
Note: Note:
参数segment的设置受CPU性能，网络带宽，运营商限制等问题影响，默认设置500个子域为任务组， --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (结果格式，默认CSV)
当你觉得你的环境不受以上因素影响，当前爆破速度较慢，那么强烈建议根据字典大小调整大小： --path 导出路径(默认None，自动生成)
十万字典建议设置为5000，百万字典设置为50000
参数valid可选值1，0，None，分别表示导出有效，无效，全部子域
参数format可选格式：'csv', 'tsv', 'json', 'yaml', 'html', 'xls', 'xlsx',
'dbf', 'latex', 'ods'
参数path为None会根据format参数和域名名称在项目结果目录生成相应文件
ARGUMENTS
TARGET
单个域名或者每行一个域名的文件路径
FLAGS
--process=PROCESS
爆破的进程数(默认CPU核心数)
--coroutine=COROUTINE
每个爆破进程下的协程数(默认64)
--wordlist=WORDLIST
指定爆破所使用的字典路径(默认使用config.py配置)
--segment=SEGMENT
爆破任务分割(默认500)
--recursive=RECURSIVE
是否使用递归爆破(默认False)
--depth=DEPTH
递归爆破的深度(默认2)
--namelist=NAMELIST
指定递归爆破所使用的字典路径(默认使用config.py配置)
--fuzz=FUZZ
是否使用fuzz模式进行爆破(默认False，开启须指定fuzz正则规则)
--rule=RULE
fuzz模式使用的正则规则(默认使用config.py配置)
--export=EXPORT
是否导出爆破结果(默认True)
--valid=VALID
导出子域的有效性(默认None)
--format=FORMAT
导出格式(默认xlsx)
--path=PATH
导出路径(默认None)
--show=SHOW
终端显示导出数据(默认False)
FLAGS
--target=TARGET
单个域名(必须提供target或targets参数)
--targets=TARGETS
每行一个域名的文件路径
--process=PROCESS
爆破的进程数(默认CPU核心数)
--coroutine=COROUTINE
每个爆破进程下的协程数(默认2000)
--wordlist=WORDLIST
指定爆破所使用的字典路径(默认使用config.py配置)
--recursive=RECURSIVE
是否使用递归爆破(默认False)
--depth=DEPTH
递归爆破的深度(默认2)
--nextlist=NEXTLIST
指定递归爆破所使用的字典路径(默认使用config.py配置)
--fuzz=FUZZ
是否使用fuzz模式进行爆破(默认False)
--rule=RULE
fuzz模式使用的正则规则(默认使用config.py配置)
--fuzzlist=FUZZLIST
指定fuzz模式所使用的字典路径(默认使用config.py配置)
--export=EXPORT
是否导出爆破结果(默认True)
--alive=ALIVE
只导出存活子域(默认False)
--format=FORMAT
导出格式(默认csv)
--path=PATH
导出路径(默认None)
``` ```
@@ -200,24 +192,26 @@ OneForAll命令行界面基于[Fire](https://github.com/google/python-fire/)实
dbexport.py - OneForAll数据库导出模块 dbexport.py - OneForAll数据库导出模块
SYNOPSIS SYNOPSIS
dbexport.py TABLE <flags> dbexport.py TARGET <flags>
DESCRIPTION DESCRIPTION
Example: Example:
python3 dbexport.py --table name --format csv --path= ./result.csv python3 dbexport.py --target name --format csv --dir= ./result.csv
python3 dbexport.py --db result.db --table name --show False python3 dbexport.py --db result.db --target name --show False
python3 dbexport.py --target table_name --tb True --show False
Note: Note:
参数port可选值有'small', 'medium', 'large', 'xlarge'，详见config.py配置 --type target/table 要导出的目标类型(默认target)
参数format可选格式有'csv', 'tsv', 'json', 'yaml', 'html', 'xls', 'xlsx', --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (结果格式，默认CSV)
'dbf', 'latex', 'ods' --path 结果路径(默认None，自动生成)
参数path为None会根据format参数和域名名称在项目结果目录生成相应文件
POSITIONAL ARGUMENTS POSITIONAL ARGUMENTS
TABLE TARGET
要导出的表 要导出的目标类型
FLAGS FLAGS
--type=TYPE
要导出的目标类型(默认target)
--db=DB --db=DB
要导出的数据库路径(默认为results/result.sqlite3) 要导出的数据库路径(默认为results/result.sqlite3)
--valid=VALID --valid=VALID
oneforall.py
-1
View File
@@ -66,7 +66,6 @@ class OneForAll(object):
python3 oneforall.py --target example.com --show True run python3 oneforall.py --target example.com --show True run
Note: Note:
--alive True/False Only export alive subdomains or not (default False)
--port small/medium/large See details in ./config/setting.py(default small) --port small/medium/large See details in ./config/setting.py(default small)
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format) --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
--path Result path (default None, automatically generated) --path Result path (default None, automatically generated)
takeover.py
+5 -5
View File
@@ -52,11 +52,11 @@ class Takeover(Module):
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format) --format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
--path Result directory (default directory is ./results) --path Result directory (default directory is ./results)
:param str target: One domain (target or targets must be provided) :param str target: One domain (target or targets must be provided)
:param str targets: File path of one domain per line :param str targets: File path of one domain per line
:param int thread: threads number (default 20) :param int thread: threads number (default 20)
:param str format: Result format (default csv) :param str format: Result format (default csv)
:param str path: Result directory (default None) :param str path: Result directory (default None)
""" """
def __init__(self, target=None, targets=None, thread=20, path=None, format='csv'): def __init__(self, target=None, targets=None, thread=20, path=None, format='csv'):