mirror of
https://github.com/shmilylty/OneForAll.git
synced 2026-08-26 12:57:50 +08:00
丰富dnsquery查询模块
This commit is contained in:
@@ -0,0 +1,35 @@
|
||||
from common.lookup import Lookup
|
||||
|
||||
|
||||
class QueryMX(Lookup):
|
||||
def __init__(self, domain):
|
||||
Lookup.__init__(self)
|
||||
self.domain = self.register(domain)
|
||||
self.module = 'dnsquery'
|
||||
self.source = "QueryMX"
|
||||
self.type = 'MX' # 利用的DNS记录的MX记录收集子域
|
||||
|
||||
def run(self):
|
||||
"""
|
||||
类执行入口
|
||||
"""
|
||||
self.begin()
|
||||
self.query()
|
||||
self.finish()
|
||||
self.save_json()
|
||||
self.gen_result()
|
||||
self.save_db()
|
||||
|
||||
|
||||
def do(domain): # 统一入口名字 方便多线程调用
|
||||
"""
|
||||
类统一调用入口
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = QueryMX(domain)
|
||||
brute.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
do('cuit.edu.cn')
|
||||
@@ -0,0 +1,35 @@
|
||||
from common.lookup import Lookup
|
||||
|
||||
|
||||
class QueryNS(Lookup):
|
||||
def __init__(self, domain):
|
||||
Lookup.__init__(self)
|
||||
self.domain = self.register(domain)
|
||||
self.module = 'dnsquery'
|
||||
self.source = "QueryNS"
|
||||
self.type = 'NS' # 利用的DNS记录的NS记录收集子域
|
||||
|
||||
def run(self):
|
||||
"""
|
||||
类执行入口
|
||||
"""
|
||||
self.begin()
|
||||
self.query()
|
||||
self.finish()
|
||||
self.save_json()
|
||||
self.gen_result()
|
||||
self.save_db()
|
||||
|
||||
|
||||
def do(domain): # 统一入口名字 方便多线程调用
|
||||
"""
|
||||
类统一调用入口
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = QueryNS(domain)
|
||||
brute.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
do('cuit.edu.cn')
|
||||
@@ -0,0 +1,35 @@
|
||||
from common.lookup import Lookup
|
||||
|
||||
|
||||
class QuerySOA(Lookup):
|
||||
def __init__(self, domain):
|
||||
Lookup.__init__(self)
|
||||
self.domain = self.register(domain)
|
||||
self.module = 'dnsquery'
|
||||
self.source = "QuerySOA"
|
||||
self.type = 'SOA' # 利用的DNS记录的SOA记录收集子域
|
||||
|
||||
def run(self):
|
||||
"""
|
||||
类执行入口
|
||||
"""
|
||||
self.begin()
|
||||
self.query()
|
||||
self.finish()
|
||||
self.save_json()
|
||||
self.gen_result()
|
||||
self.save_db()
|
||||
|
||||
|
||||
def do(domain): # 统一入口名字 方便多线程调用
|
||||
"""
|
||||
类统一调用入口
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = QuerySOA(domain)
|
||||
brute.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
do('cuit.edu.cn')
|
||||
@@ -7,7 +7,6 @@ import queue
|
||||
import threading
|
||||
|
||||
from common import utils
|
||||
from common import resolve
|
||||
from common.module import Module
|
||||
from config import data_storage_dir, logger
|
||||
|
||||
@@ -47,10 +46,13 @@ class BruteSRV(Module):
|
||||
|
||||
while not self.answers_que.empty():
|
||||
answer = self.answers_que.get()
|
||||
if answer is not None:
|
||||
for item in answer:
|
||||
subdomains = utils.match_subdomain(self.domain, str(item))
|
||||
self.subdomains = self.subdomains.union(subdomains)
|
||||
if answer is None:
|
||||
continue
|
||||
for item in answer:
|
||||
record = str(item)
|
||||
subdomains = utils.match_subdomain(self.domain, record)
|
||||
self.subdomains = self.subdomains.union(subdomains)
|
||||
self.gen_record(subdomains, record)
|
||||
|
||||
def run(self):
|
||||
"""
|
||||
@@ -69,29 +71,11 @@ class BruteThread(threading.Thread):
|
||||
threading.Thread.__init__(self)
|
||||
self.names_que = names_que
|
||||
self.answers_que = answers_que
|
||||
self.resolver = resolve.dns_resolver()
|
||||
|
||||
def query(self, name):
|
||||
"""
|
||||
查询域名的SRV记录
|
||||
:param str name: SRV记录
|
||||
:return: 查询结果
|
||||
"""
|
||||
logger.log('TRACE', f'尝试查询{name}的SRV记录')
|
||||
try:
|
||||
answer = self.resolver.query(name, 'SRV')
|
||||
except Exception as e:
|
||||
logger.log('TRACE', e.args)
|
||||
logger.log('TRACE', f'查询{name}的SRV记录失败')
|
||||
return None
|
||||
else:
|
||||
logger.log('TRACE', f'查询{name}的SRV记录成功')
|
||||
return answer
|
||||
|
||||
def run(self):
|
||||
while True:
|
||||
name = self.names_que.get()
|
||||
answer = self.query(name)
|
||||
answer = utils.dns_query(name, 'SRV')
|
||||
self.answers_que.put(answer)
|
||||
self.names_que.task_done()
|
||||
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
from common.lookup import Lookup
|
||||
|
||||
|
||||
class QueryTXT(Lookup):
|
||||
def __init__(self, domain):
|
||||
Lookup.__init__(self)
|
||||
self.domain = self.register(domain)
|
||||
self.module = 'dnsquery'
|
||||
self.source = "QueryTXT"
|
||||
self.type = 'TXT' # 利用的DNS记录的TXT记录收集子域
|
||||
|
||||
def run(self):
|
||||
"""
|
||||
类执行入口
|
||||
"""
|
||||
self.begin()
|
||||
self.query()
|
||||
self.finish()
|
||||
self.save_json()
|
||||
self.gen_result()
|
||||
self.save_db()
|
||||
|
||||
|
||||
def do(domain): # 统一入口名字 方便多线程调用
|
||||
"""
|
||||
类统一调用入口
|
||||
|
||||
:param str domain: 域名
|
||||
"""
|
||||
brute = QueryTXT(domain)
|
||||
brute.run()
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
do('cuit.edu.cn')
|
||||
Reference in New Issue
Block a user