mirror of
https://github.com/shmilylty/OneForAll.git
synced 2026-08-26 04:47:48 +08:00
更新文档
This commit is contained in:
Jing Ling
@@ -533,14 +533,13 @@ class Brute(Module):
|
||||
Example：
|
||||
brute.py --target domain.com --word True run
|
||||
brute.py --targets ./domains.txt --word True run
|
||||
brute.py --target domain.com --word True --process 1 run
|
||||
brute.py --target domain.com --word True --concurrent 2000 run
|
||||
brute.py --target domain.com --word True --wordlist subnames.txt run
|
||||
brute.py --target domain.com --word True --recursive True --depth 2 run
|
||||
brute.py --target d.com --fuzz True --place m.*.d.com --rule '[a-z]' run
|
||||
brute.py --target d.com --fuzz True --place m.*.d.com --fuzzlist subnames.txt run
|
||||
|
||||
Note:
|
||||
--alive True/False Only export alive subdomains or not (default False)
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
|
||||
--path Result path (default None, automatically generated)
|
||||
|
||||
@@ -548,7 +547,7 @@ class Brute(Module):
|
||||
:param str target: One domain (target or targets must be provided)
|
||||
:param str targets: File path of one domain per line
|
||||
:param int process: Number of processes (default 1)
|
||||
:param int concurrent: Number of concurrent (default 10000)
|
||||
:param int concurrent: Number of concurrent (default 2000)
|
||||
:param bool word: Use word mode generate dictionary (default False)
|
||||
:param str wordlist: Dictionary path used in word mode (default use ./config/default.py)
|
||||
:param bool recursive: Use recursion (default False)
|
||||
|
||||
@@ -29,7 +29,6 @@ def export(target, type='target', db=None, alive=False, limit=None, path=None, f
|
||||
python3 dbexport.py --target table_name --tb True --show False
|
||||
|
||||
Note:
|
||||
--alive True/False Only export alive subdomains or not (default False)
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
|
||||
--path Result directory (default directory is ./results)
|
||||
|
||||
@@ -82,4 +81,3 @@ def export(target, type='target', db=None, alive=False, limit=None, path=None, f
|
||||
|
||||
if __name__ == '__main__':
|
||||
fire.Fire(export)
|
||||
# export('example.com')
|
||||
|
||||
+132
-59
@@ -10,17 +10,17 @@ The OneForAll command line interface is based on [Fire](https://github.com/googl
|
||||
|
||||
1. **oneforall.py help**
|
||||
|
||||
```bash
|
||||
python oneforall.py --help
|
||||
```
|
||||
```bash
|
||||
NAME
|
||||
```bash
|
||||
python oneforall.py --help
|
||||
```
|
||||
```bash
|
||||
NAME
|
||||
oneforall.py - OneForAll help summary page
|
||||
|
||||
SYNOPSIS
|
||||
SYNOPSIS
|
||||
oneforall.py COMMAND | <flags>
|
||||
|
||||
DESCRIPTION
|
||||
DESCRIPTION
|
||||
OneForAll is a powerful subdomain integration tool
|
||||
|
||||
Example:
|
||||
@@ -39,12 +39,11 @@ The OneForAll command line interface is based on [Fire](https://github.com/googl
|
||||
|
||||
|
||||
Note:
|
||||
--alive True/False Only export alive subdomains or not (default False)
|
||||
--port small/medium/large See details in ./config/setting.py(default small)
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
|
||||
--path Result path (default None, automatically generated)
|
||||
|
||||
FLAGS
|
||||
FLAGS
|
||||
--target=TARGET
|
||||
One domain (target or targets parameters must be provided)
|
||||
--targets=TARGETS
|
||||
@@ -66,7 +65,7 @@ The OneForAll command line interface is based on [Fire](https://github.com/googl
|
||||
--takeover=TAKEOVER
|
||||
Scan subdomain takeover (default False)
|
||||
|
||||
COMMANDS
|
||||
COMMANDS
|
||||
COMMAND is one of the following:
|
||||
|
||||
check
|
||||
@@ -74,77 +73,151 @@ The OneForAll command line interface is based on [Fire](https://github.com/googl
|
||||
|
||||
version
|
||||
Print version information and exit
|
||||
```
|
||||
```
|
||||
|
||||
2. **aiobrute.py help**
|
||||
|
||||
With regard to the handling of the universal parsing problem, first of all, OneForAll accesses a random subdomain to determine whether universal parsing is used, and if universal parsing is used, it is handled by the following judgment:
|
||||
- First, it is mainly compared with the pan-parsed IP set and TTL values, see [this article](http://sh3ll.me/archives/201704041222.txt).
|
||||
With regard to the handling of the universal parsing problem, first of all, OneForAll accesses a random subdomain to determine whether universal parsing is used, and if universal parsing is used, it is handled by the following judgment:
|
||||
- First, it is mainly compared with the pan-parsed IP set and TTL values, see [this article](http://sh3ll.me/archives/201704041222.txt).
|
||||
|
||||
- Second, the number of times to resolve to the same IP collection multiple times (the default is 10, which can be set to size in config.py).
|
||||
- Second, the number of times to resolve to the same IP collection multiple times (the default is 10, which can be set to size in config.py).
|
||||
|
||||
- Third, considering the blasting efficiency, there is no HTTP response volume similarity comparison and response volume content judgment, this function has not been implemented yet, and will be implemented if necessary.
|
||||
- Third, considering the blasting efficiency, there is no HTTP response volume similarity comparison and response volume content judgment, this function has not been implemented yet, and will be implemented if necessary.
|
||||
|
||||
|
||||
```bash
|
||||
python aiobrute.py --help
|
||||
```
|
||||
```bash
|
||||
python brute.py --help
|
||||
```
|
||||
|
||||
```bash
|
||||
NAME
|
||||
aiobrute.py - OneForAll multi-process multi-correlation asynchronous subdomain blasting module
|
||||
```bash
|
||||
NAME
|
||||
brute.py - OneForAll subdomain brute module
|
||||
|
||||
SYNOPSIS
|
||||
aiobrute.py --target=TARGET <flags>
|
||||
SYNOPSIS
|
||||
brute.py <flags>
|
||||
|
||||
DESCRIPTION
|
||||
DESCRIPTION
|
||||
Example：
|
||||
python3 aiobrute.py --target example.com run
|
||||
python3 aiobrute.py --target ./domains.txt run
|
||||
python3 aiobrute.py --target example.com --process 4 --coroutine 64 run
|
||||
python3 aiobrute.py --target example.com --wordlist subdomains.txt run
|
||||
python3 aiobrute.py --target example.com --recursive True --depth 2 run
|
||||
python3 aiobrute.py --target m.{fuzz}.a.bz --fuzz True --rule [a-z] run
|
||||
brute.py --target domain.com --word True run
|
||||
brute.py --targets ./domains.txt --word True run
|
||||
brute.py --target domain.com --word True --concurrent 2000 run
|
||||
brute.py --target domain.com --word True --wordlist subnames.txt run
|
||||
brute.py --target domain.com --word True --recursive True --depth 2 run
|
||||
brute.py --target d.com --fuzz True --place m.*.d.com --rule '[a-z]' run
|
||||
brute.py --target d.com --fuzz True --place m.*.d.com --fuzzlist subnames.txt run
|
||||
|
||||
Note:
|
||||
Parameter valid optional value 1, 0, none indicates that the export is
|
||||
valid, invalid, and all subdomains, respectively.
|
||||
|
||||
Parameter format have optional values 'txt', 'rst', 'csv', 'tsv', 'json',
|
||||
'yaml', 'html', 'jira', 'xls', 'xlsx', 'dbf', 'latex', 'ods'.
|
||||
If the parameter path is None, the appropriate file is generated in the
|
||||
project result directory based on the format parameter and the domain
|
||||
name.
|
||||
|
||||
ARGUMENTS
|
||||
TARGET
|
||||
Single domain name or file path for one domain name per line (required)
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
|
||||
--path Result path (default None, automatically generated)
|
||||
|
||||
FLAGS
|
||||
--target=TARGET
|
||||
One domain (target or targets must be provided)
|
||||
--targets=TARGETS
|
||||
File path of one domain per line
|
||||
--process=PROCESS
|
||||
Number of processes blasted (default CPU core count)
|
||||
--coroutine=COROUTINE
|
||||
Number of coroutines per blasting process (default 1024)
|
||||
Number of processes (default 1)
|
||||
--concurrent=CONCURRENT
|
||||
Number of concurrent (default 2000)
|
||||
--word=WORD
|
||||
Use word mode generate dictionary (default False)
|
||||
--wordlist=WORDLIST
|
||||
Specify the dictionary path used for blasting (config.py is used by default)
|
||||
Dictionary path used in word mode (default use ./config/default.py)
|
||||
--recursive=RECURSIVE
|
||||
Whether to use recursive blasting (default False)
|
||||
Use recursion (default False)
|
||||
--depth=DEPTH
|
||||
Depth of recursive blasting (default 2)
|
||||
--namelist=NAMELIST
|
||||
Specifies the dictionary path used by recursive blasting (configured by default using config.py)
|
||||
Recursive depth (default 2)
|
||||
--nextlist=NEXTLIST
|
||||
Dictionary file path used by recursive (default use ./config/default.py)
|
||||
--fuzz=FUZZ
|
||||
Whether to use the fuzz mode for blasting (default False, you must specify the fuzz regular rule)
|
||||
Use fuzz mode generate dictionary (default False)
|
||||
--place=PLACE
|
||||
Designated fuzz position (required if use fuzz mode)
|
||||
--rule=RULE
|
||||
Regular rules used by fuzz mode (configured by default using config.py)
|
||||
Specify the regexp rules used in fuzz mode (required if use fuzz mode)
|
||||
--fuzzlist=FUZZLIST
|
||||
Dictionary path used in fuzz mode (default use ./config/default.py)
|
||||
--export=EXPORT
|
||||
Whether to export the blast result (default True)
|
||||
--valid=VALID
|
||||
Export validity of subdomains (default None)
|
||||
Export the results (default True)
|
||||
--alive=ALIVE
|
||||
Only export alive subdomains (default False)
|
||||
--format=FORMAT
|
||||
Export format (default xls)
|
||||
Result format (default csv)
|
||||
--path=PATH
|
||||
Export path (default None)
|
||||
Result directory (default None)
|
||||
```
|
||||
|
||||
3. **takeover.py help**
|
||||
|
||||
```bash
|
||||
python takeover.py --help
|
||||
```
|
||||
|
||||
```bash
|
||||
NAME
|
||||
takeover.py - OneForAll subdomain takeover module SYNOPSIS takeover.py <flags> DESCRIPTION
|
||||
|
||||
Example:
|
||||
python3 takeover.py --target www.example.com --format csv run
|
||||
python3 takeover.py --targets ./subdomains.txt --thread 10 run
|
||||
|
||||
Note:
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
|
||||
--path Result directory (default directory is ./results)
|
||||
|
||||
FLAGS
|
||||
--target=TARGET
|
||||
One domain (target or targets must be provided)
|
||||
--targets=TARGETS
|
||||
File path of one domain per line
|
||||
--thread=THREAD
|
||||
threads number (default 20)
|
||||
--path=PATH
|
||||
Result directory (default None)
|
||||
--format=FORMAT
|
||||
Result format (default csv)
|
||||
```
|
||||
|
||||
4. **dbexport.py help**
|
||||
|
||||
```bash
|
||||
python dbexport.py --help
|
||||
```
|
||||
|
||||
```bash
|
||||
NAME
|
||||
dbexport.py - OneForAll export from database module
|
||||
|
||||
SYNOPSIS
|
||||
dbexport.py TARGET <flags>
|
||||
|
||||
DESCRIPTION
|
||||
Example:
|
||||
python3 dbexport.py --target name --format csv --dir= ./result.csv
|
||||
python3 dbexport.py --db result.db --target name --show False
|
||||
python3 dbexport.py --target table_name --tb True --show False
|
||||
|
||||
Note:
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
|
||||
--path Result directory (default directory is ./results)
|
||||
|
||||
POSITIONAL ARGUMENTS
|
||||
TARGET
|
||||
Table to be exported
|
||||
|
||||
FLAGS
|
||||
--type=TYPE
|
||||
Type of target
|
||||
--db=DB
|
||||
Database path to be exported (default ./results/result.sqlite3)
|
||||
--alive=ALIVE
|
||||
Only export the results of alive subdomains (default False)
|
||||
--limit=LIMIT
|
||||
Export limit (default None)
|
||||
--path=PATH
|
||||
Result directory (default None)
|
||||
--format=FORMAT
|
||||
Result format (default csv)
|
||||
--show=SHOW
|
||||
Terminal display exported data (default False)
|
||||
```
|
||||
Displays the exported data in terminal (default False)
|
||||
```
|
||||
+34
-40
@@ -38,7 +38,6 @@ OneForAll命令行界面基于[Fire](https://github.com/google/python-fire/)实
|
||||
python3 oneforall.py --target example.com --show True run
|
||||
|
||||
Note:
|
||||
--alive True/False 只导出存活子域(默认False)
|
||||
--port small/medium/large 详见./config/setting.py(默认small)
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (结果格式，默认CSV)
|
||||
--path 结果路径(默认None，自动生成)
|
||||
@@ -90,63 +89,56 @@ OneForAll命令行界面基于[Fire](https://github.com/google/python-fire/)实
|
||||
|
||||
```bash
|
||||
NAME
|
||||
aiobrute.py - OneForAll多进程多协程异步子域爆破模块
|
||||
brute.py - OneForAll子域爆破模块
|
||||
|
||||
SYNOPSIS
|
||||
aiobrute.py --target=TARGET <flags>
|
||||
brute.py <flags>
|
||||
|
||||
DESCRIPTION
|
||||
Example：
|
||||
python3 aiobrute.py --target example.com run
|
||||
python3 aiobrute.py --target ./domains.txt run
|
||||
python3 aiobrute.py --target example.com --process 4 --coroutine 64 run
|
||||
python3 aiobrute.py --target example.com --wordlist subdomains.txt run
|
||||
python3 aiobrute.py --target example.com --recursive True --depth 2 run
|
||||
python3 aiobrute.py --target m.{fuzz}.a.bz --fuzz True --rule [a-z] run
|
||||
brute.py --target domain.com --word True run
|
||||
brute.py --targets ./domains.txt --word True run
|
||||
brute.py --target domain.com --word True --coroutine 2000 run
|
||||
brute.py --target domain.com --word True --wordlist subnames.txt run
|
||||
brute.py --target domain.com --word True --recursive True --depth 2 run
|
||||
brute.py --target d.com --fuzz True --place m.*.d.com --rule '[a-z]' run
|
||||
brute.py --target d.com --fuzz True --place m.*.d.com --fuzzlist subnames.txt run
|
||||
|
||||
Note:
|
||||
参数segment的设置受CPU性能，网络带宽，运营商限制等问题影响，默认设置500个子域为任务组，
|
||||
当你觉得你的环境不受以上因素影响，当前爆破速度较慢，那么强烈建议根据字典大小调整大小：
|
||||
十万字典建议设置为5000，百万字典设置为50000
|
||||
参数valid可选值1，0，None，分别表示导出有效，无效，全部子域
|
||||
参数format可选格式：'csv', 'tsv', 'json', 'yaml', 'html', 'xls', 'xlsx',
|
||||
'dbf', 'latex', 'ods'
|
||||
参数path为None会根据format参数和域名名称在项目结果目录生成相应文件
|
||||
|
||||
ARGUMENTS
|
||||
TARGET
|
||||
单个域名或者每行一个域名的文件路径
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (结果格式，默认CSV)
|
||||
--path 导出路径(默认None，自动生成)
|
||||
|
||||
FLAGS
|
||||
--target=TARGET
|
||||
单个域名(必须提供target或targets参数)
|
||||
--targets=TARGETS
|
||||
每行一个域名的文件路径
|
||||
--process=PROCESS
|
||||
爆破的进程数(默认CPU核心数)
|
||||
--coroutine=COROUTINE
|
||||
每个爆破进程下的协程数(默认64)
|
||||
每个爆破进程下的协程数(默认2000)
|
||||
--wordlist=WORDLIST
|
||||
指定爆破所使用的字典路径(默认使用config.py配置)
|
||||
--segment=SEGMENT
|
||||
爆破任务分割(默认500)
|
||||
--recursive=RECURSIVE
|
||||
是否使用递归爆破(默认False)
|
||||
--depth=DEPTH
|
||||
递归爆破的深度(默认2)
|
||||
--namelist=NAMELIST
|
||||
--nextlist=NEXTLIST
|
||||
指定递归爆破所使用的字典路径(默认使用config.py配置)
|
||||
--fuzz=FUZZ
|
||||
是否使用fuzz模式进行爆破(默认False，开启须指定fuzz正则规则)
|
||||
是否使用fuzz模式进行爆破(默认False)
|
||||
--rule=RULE
|
||||
fuzz模式使用的正则规则(默认使用config.py配置)
|
||||
--fuzzlist=FUZZLIST
|
||||
指定fuzz模式所使用的字典路径(默认使用config.py配置)
|
||||
--export=EXPORT
|
||||
是否导出爆破结果(默认True)
|
||||
--valid=VALID
|
||||
导出子域的有效性(默认None)
|
||||
--alive=ALIVE
|
||||
只导出存活子域(默认False)
|
||||
--format=FORMAT
|
||||
导出格式(默认xlsx)
|
||||
导出格式(默认csv)
|
||||
--path=PATH
|
||||
导出路径(默认None)
|
||||
--show=SHOW
|
||||
终端显示导出数据(默认False)
|
||||
|
||||
```
|
||||
|
||||
|
||||
@@ -200,24 +192,26 @@ OneForAll命令行界面基于[Fire](https://github.com/google/python-fire/)实
|
||||
dbexport.py - OneForAll数据库导出模块
|
||||
|
||||
SYNOPSIS
|
||||
dbexport.py TABLE <flags>
|
||||
dbexport.py TARGET <flags>
|
||||
|
||||
DESCRIPTION
|
||||
Example:
|
||||
python3 dbexport.py --table name --format csv --path= ./result.csv
|
||||
python3 dbexport.py --db result.db --table name --show False
|
||||
python3 dbexport.py --target name --format csv --dir= ./result.csv
|
||||
python3 dbexport.py --db result.db --target name --show False
|
||||
python3 dbexport.py --target table_name --tb True --show False
|
||||
|
||||
Note:
|
||||
参数port可选值有'small', 'medium', 'large', 'xlarge'，详见config.py配置
|
||||
参数format可选格式有'csv', 'tsv', 'json', 'yaml', 'html', 'xls', 'xlsx',
|
||||
'dbf', 'latex', 'ods'
|
||||
参数path为None会根据format参数和域名名称在项目结果目录生成相应文件
|
||||
--type target/table 要导出的目标类型(默认target)
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (结果格式，默认CSV)
|
||||
--path 结果路径(默认None，自动生成)
|
||||
|
||||
POSITIONAL ARGUMENTS
|
||||
TABLE
|
||||
要导出的表
|
||||
TARGET
|
||||
要导出的目标类型
|
||||
|
||||
FLAGS
|
||||
--type=TYPE
|
||||
要导出的目标类型(默认target)
|
||||
--db=DB
|
||||
要导出的数据库路径(默认为results/result.sqlite3)
|
||||
--valid=VALID
|
||||
|
||||
@@ -66,7 +66,6 @@ class OneForAll(object):
|
||||
python3 oneforall.py --target example.com --show True run
|
||||
|
||||
Note:
|
||||
--alive True/False Only export alive subdomains or not (default False)
|
||||
--port small/medium/large See details in ./config/setting.py(default small)
|
||||
--format rst/csv/tsv/json/yaml/html/jira/xls/xlsx/dbf/latex/ods (result format)
|
||||
--path Result path (default None, automatically generated)
|
||||
|
||||
Reference in New Issue
Block a user