mirror of
https://github.com/shmilylty/OneForAll.git
synced 2026-08-26 04:47:48 +08:00
Merge branch 'master' into translation
This commit is contained in:
Jing Ling
@@ -30,7 +30,7 @@
|
||||
|
||||
* **收集能力强大**，详细模块请阅读[收集模块说明](https://github.com/shmilylty/OneForAll/tree/master/docs/collection_modules.md)。
|
||||
1. 利用证书透明度收集子域（目前有6个模块：`censys_api`，`certspotter`，`crtsh`，`entrust`，`google`，`spyse_api`）
|
||||
2. 常规检查收集子域（目前有4个模块：域传送漏洞利用`axfr`，检查跨域策略文件`cdx`，检查HTTPS证书`cert`，检查内容安全策略`csp`，检查robots文件`robots`，检查sitemap文件`sitemap`，后续会添加检查NSEC记录，NSEC3记录等模块）
|
||||
2. 常规检查收集子域（目前有4个模块：域传送漏洞利用`axfr`，检查跨域策略文件`cdx`，检查HTTPS证书`cert`，检查内容安全策略`csp`，检查robots文件`robots`，检查sitemap文件`sitemap`，利用NSEC记录遍历DNS域`dnssec`，后续会添加NSEC3记录等模块）
|
||||
3. 利用网上爬虫档案收集子域（目前有2个模块：`archivecrawl`，`commoncrawl`，此模块还在调试，该模块还有待添加和完善）
|
||||
4. 利用DNS数据集收集子域（目前有23个模块：`binaryedge_api`, `bufferover`, `cebaidu`, `chinaz`, `chinaz_api`, `circl_api`, `dnsdb_api`, `dnsdumpster`, `hackertarget`, `ip138`, `ipv4info_api`, `netcraft`, `passivedns_api`, `ptrarchive`, `qianxun`, `rapiddns`, `riddler`, `robtex`, `securitytrails_api`, `sitedossier`, `threatcrowd`, `wzpc`, `ximcx`）
|
||||
5. 利用DNS查询收集子域（目前有5个模块：通过枚举常见的SRV记录并做查询来收集子域`srv`，以及通过查询域名的DNS记录中的MX,NS,SOA,TXT记录来收集子域）
|
||||
|
||||
@@ -33,10 +33,10 @@ At present, OneForAll is under development, there must be a lot of problems and
|
||||
|
||||
* **Powerful collection capability**, For more details, please read [collection module description](https://github.com/shmilylty/OneForAll/tree/master/docs/collection_modules.md).
|
||||
1. Use 6 certificate modules: `censys_api`, `certspotter`, `crtsh`, `entrust`, `google`, `spyse_api`.
|
||||
2. Use 6 baseline testing modules: scan domain transfer vulnerability `axfr`, cross-domain policy file `cdx`, HTTPS certificate `cert`, content security policy `csp`, robots file `robots`, and sitemap file `sitemap`. NSEC record, NSEC3 record and other modules will be added later.
|
||||
2. Use 6 baseline testing modules: scan domain transfer vulnerability `axfr`, cross-domain policy file `cdx`, HTTPS certificate `cert`, content security policy `csp`, robots file `robots`, and sitemap file `sitemap`, NSEC record `nsec`. NSEC3 record and other modules will be added later.
|
||||
3. Use 2 web crawler modules: `archirawl`, `commoncrawl`, which is still being debugged and needs to be added and improved).
|
||||
4. Use 23 DNS datasets modules: `binaryedge_api`, `bufferover`, `cebaidu`, `chinaz`, `chinaz_api`, `circl_api`, `dnsdb_api`, `dnsdumpster`, `hackertarget`, `ip138`, `ipv4info_api`, `netcraft`, `passivedns_api`, `ptrarchive`, `qianxun`, `rapiddns`, `riddler`, `robtex`, `securitytrails_api`, `sitedossier`, `threatcrowd`, `wzpc`, `ximcx`.
|
||||
5. Use 5 DNS queries modules: enumerating SRV records `srv` and collect from `MX`, `NS`, `SOA`, `TXT`.
|
||||
5. Use 6 DNS queries modules: enumerating SRV records `srv` and collect from `MX`, `NS`, `SOA`, `TXT`, `SPF`.
|
||||
6. Use 6 threat intelligence modules: `alienvault`, `riskiq_ api`, `threatbook_ api`, `threatkeeper `, `virustotal`, `virustotal_ api`, which need to be added and improved.
|
||||
7. Use 16 search engines modules: `ask`, `baidu`, `bing`, `bing_api`, `fofa_api`, `gitee`, `github_api`, `google`, `google_api`, `shodan_api`, `so`, `sogou`, `yahoo`, `yandex`, `zoomeye_api`, except for special search engines. General search engines support automatic exclusion of search, full search and recursive search.
|
||||
* **Support subdomain brute force**, can use dictionary mode or custom fuzz mode. Supports bulk brute and recursive brute, and automatically determine wildcard or not and processing.
|
||||
@@ -48,6 +48,7 @@ At present, OneForAll is under development, there must be a lot of problems and
|
||||
|
||||
If you have any other good ideas, please let me know!😎
|
||||
|
||||
|
||||
## 🚀Start Guide
|
||||
|
||||
📢 Please read this document to help you start quickly!
|
||||
|
||||
@@ -0,0 +1,56 @@
|
||||
# https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-20-zh
|
||||
# https://appsecco.com/books/subdomain-enumeration/active_techniques/zone_walking.html
|
||||
|
||||
from common.module import Module
|
||||
from common import utils
|
||||
|
||||
|
||||
class CheckNSEC(Module):
|
||||
def __init__(self, domain):
|
||||
Module.__init__(self)
|
||||
self.domain = self.register(domain)
|
||||
self.module = 'check'
|
||||
self.source = "CheckNSEC"
|
||||
|
||||
def walk(self):
|
||||
domain = self.domain
|
||||
while True:
|
||||
answer = utils.dns_query(domain, 'NSEC')
|
||||
if answer is None:
|
||||
break
|
||||
subdomain = str()
|
||||
for item in answer:
|
||||
record = item.to_text()
|
||||
subdomains = self.match_subdomains(self.domain, record)
|
||||
subdomain = ''.join(subdomains) # 其实这里的subdomains的长度为1 也就是说只会有一个子域
|
||||
self.subdomains = self.subdomains.union(subdomains)
|
||||
self.gen_record(subdomains, record)
|
||||
if subdomain == self.domain: # 当查出子域为主域 说明完成了一个循环 不再继续查询
|
||||
break
|
||||
domain = subdomain
|
||||
return self.subdomains
|
||||
|
||||
def run(self):
|
||||
"""
|
||||
类执行入口
|
||||
"""
|
||||
self.begin()
|
||||
self.walk()
|
||||
self.finish()
|
||||
self.save_json()
|
||||
self.gen_result()
|
||||
self.save_db()
|
||||
|
||||
|
||||
def do(domain): # 统一入口名字 方便多线程调用
|
||||
"""
|
||||
类统一调用入口
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = CheckNSEC(domain)
|
||||
brute.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
do('iana.org')
|
||||
@@ -27,8 +27,8 @@ def do(domain): # 统一入口名字 方便多线程调用
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = QueryMX(domain)
|
||||
brute.run()
|
||||
query = QueryMX(domain)
|
||||
query.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
|
||||
@@ -27,8 +27,8 @@ def do(domain): # 统一入口名字 方便多线程调用
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = QueryNS(domain)
|
||||
brute.run()
|
||||
query = QueryNS(domain)
|
||||
query.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
|
||||
@@ -27,8 +27,8 @@ def do(domain): # 统一入口名字 方便多线程调用
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = QuerySOA(domain)
|
||||
brute.run()
|
||||
query = QuerySOA(domain)
|
||||
query.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
from common.lookup import Lookup
|
||||
|
||||
|
||||
class QuerySPF(Lookup):
|
||||
def __init__(self, domain):
|
||||
Lookup.__init__(self)
|
||||
self.domain = self.register(domain)
|
||||
self.module = 'dnsquery'
|
||||
self.source = "QuerySPF"
|
||||
self.type = 'SPF' # 利用的DNS记录的SPF记录收集子域
|
||||
|
||||
def run(self):
|
||||
"""
|
||||
类执行入口
|
||||
"""
|
||||
self.begin()
|
||||
self.query()
|
||||
self.finish()
|
||||
self.save_json()
|
||||
self.gen_result()
|
||||
self.save_db()
|
||||
|
||||
|
||||
def do(domain): # 统一入口名字 方便多线程调用
|
||||
"""
|
||||
类统一调用入口
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = QuerySPF(domain)
|
||||
brute.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
do('qq.com')
|
||||
@@ -27,8 +27,8 @@ def do(domain): # 统一入口名字 方便多线程调用
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = QueryTXT(domain)
|
||||
brute.run()
|
||||
query = QueryTXT(domain)
|
||||
query.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
|
||||
Reference in New Issue
Block a user