This commit is contained in:
shmilylty
2019-08-07 01:32:49 +08:00
parent 8ba3b926ce
commit b628859d32
45 changed files with 253 additions and 172 deletions
@@ -52,5 +52,4 @@ def do(domain): # 统一入口名字 方便多线程调用
if __name__ == '__main__':
do('example.com')
+2 -3
View File
@@ -22,7 +22,8 @@ class BufferOver(Query):
if not resp:
return
subdomains_find = self.match(self.domain, resp.text)
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -41,12 +42,10 @@ def do(domain): # 统一入口名字 方便多线程调用
类统一调用入口
:param str domain: 域名
"""
query = BufferOver(domain)
query.run()
if __name__ == '__main__':
do('example.com')
-1
View File
@@ -48,5 +48,4 @@ def do(domain): # 统一入口名字 方便多线程调用
if __name__ == '__main__':
do('example.com')
+2 -2
View File
@@ -24,7 +24,8 @@ class ChinazAPI(Query):
if not resp:
return
subdomains_find = self.match(self.domain, str(resp.json()))
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -51,5 +52,4 @@ def do(domain): # 统一入口名字 方便多线程调用
if __name__ == '__main__':
do('example.com')
+2 -2
View File
@@ -24,7 +24,8 @@ class CirclAPI(Query):
if not resp:
return
subdomains_find = self.match(self.domain, str(resp.json()))
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -51,5 +52,4 @@ def do(domain): # 统一入口名字 方便多线程调用
if __name__ == '__main__':
do('example.com')
+6 -3
View File
@@ -28,16 +28,19 @@ class DNSdb(Query):
soup = BeautifulSoup(resp.text, features='lxml')
index_urls = set(map(lambda x: self.addr + self.domain + x.text, soup.find_all('a')))
for url in index_urls:
self.delay = random.randint(2, 5) # 休眠绕过CloudFlare的DDoS保护
# 休眠绕过CloudFlare的DDoS保护
self.delay = random.randint(2, 5)
time.sleep(self.delay)
resp = self.get(url)
if not resp:
return
subdomains_find = self.match(self.domain, resp.text)
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
else:
subdomains_find = self.match(self.domain, resp.text)
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
+2 -2
View File
@@ -27,7 +27,8 @@ class DNSdbAPI(Query):
return
if resp.status_code == 200:
subdomains_find = utils.match_subdomain(self.domain, resp.text)
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -55,5 +56,4 @@ def do(domain): # 统一入口名字 方便多线程调用
if __name__ == '__main__':
do('example.com')
+2 -6
View File
@@ -4,10 +4,6 @@ from common.query import Query
class DNSdumpster(Query):
"""
"""
def __init__(self, domain):
Query.__init__(self)
self.domain = self.register(domain)
@@ -33,7 +29,8 @@ class DNSdumpster(Query):
return
subdomains_find = utils.match_subdomain(self.domain, resp.text)
if subdomains_find:
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -52,7 +49,6 @@ def do(domain): # 统一入口名字 方便多线程调用
类统一调用入口
:param str domain: 域名
"""
query = DNSdumpster(domain)
query.run()
+2 -3
View File
@@ -23,7 +23,8 @@ class HackerTarget(Query):
if resp.status_code == 200:
subdomains_find = utils.match_subdomain(self.domain, resp.text)
if subdomains_find:
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -42,12 +43,10 @@ def do(domain): # 统一入口名字 方便多线程调用
类统一调用入口
:param str domain: 域名
"""
query = HackerTarget(domain)
query.run()
if __name__ == '__main__':
do('example.com')
+8 -6
View File
@@ -19,7 +19,8 @@ class IPv4InfoAPI(Query):
while True:
self.header = self.get_header()
self.proxy = self.get_proxy(self.source)
params = {'type': 'SUBDOMAINS', 'key': self.api, 'value': self.domain, 'page': page}
params = {'type': 'SUBDOMAINS', 'key': self.api,
'value': self.domain, 'page': page}
resp = self.get(self.addr, params)
if not resp:
return
@@ -29,9 +30,12 @@ class IPv4InfoAPI(Query):
subdomains_find = self.match(self.domain, str(resp_json))
if not subdomains_find:
break
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
subdomains = resp_json.get('Subdomains') # 不直接使用subdomains是因为可能里面会出现不符合标准的子域名
if len(subdomains) < 300: # ipv4info子域查询接口每次最多返回300个 用来判断是否还有下一页
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
# 不直接使用subdomains是因为可能里面会出现不符合标准的子域名
subdomains = resp_json.get('Subdomains')
# ipv4info子域查询接口每次最多返回300个 用来判断是否还有下一页
if len(subdomains) < 300:
break
page += 1
if page >= 50: # ipv4info子域查询接口最多允许查询50页
@@ -54,12 +58,10 @@ def do(domain): # 统一入口名字 方便多线程调用
类统一调用入口
:param str domain: 域名
"""
query = IPv4InfoAPI(domain)
query.run()
if __name__ == '__main__':
do('example.com')
+4 -4
View File
@@ -27,7 +27,8 @@ class NetCraft(Query):
return None
self.cookie = self.get(self.init).cookies
cookie_value = self.cookie['netcraft_js_verification_challenge']
verify_taken = hashlib.sha1(parse.unquote(cookie_value).encode('utf-8')).hexdigest()
cookie_encode = parse.unquote(cookie_value).encode('utf-8')
verify_taken = hashlib.sha1(cookie_encode).hexdigest()
self.cookie['netcraft_js_verification_response'] = verify_taken
def query(self):
@@ -48,7 +49,8 @@ class NetCraft(Query):
subdomains_find = self.match(self.domain, resp.text)
if not subdomains_find: # 搜索没有发现子域名则停止搜索
break
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
if 'Next page' not in resp.text: # 搜索页面没有出现下一页时停止搜索
break
last = re.search(r'&last=.*' + self.domain, resp.text).group(0)
@@ -71,12 +73,10 @@ def do(domain): # 统一入口名字 方便多线程调用
类统一调用入口
:param str domain: 域名
"""
query = NetCraft(domain)
query.run()
if __name__ == '__main__':
do('example.com')
+4 -3
View File
@@ -18,7 +18,8 @@ class PTRArchive(Query):
"""
self.header = self.get_header()
self.proxy = self.get_proxy(self.source)
self.cookie = {'pa_id': str(random.randint(0, 1000000000))} # 绕过主页前端JS验证
# 绕过主页前端JS验证
self.cookie = {'pa_id': str(random.randint(0, 1000000000))}
params = {'label': self.domain, 'date': 'ALL'}
resp = self.get(self.addr, params)
if not resp:
@@ -26,7 +27,8 @@ class PTRArchive(Query):
if resp.status_code == 200:
subdomains_find = utils.match_subdomain(self.domain, resp.text)
if subdomains_find:
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -51,5 +53,4 @@ def do(domain): # 统一入口名字 方便多线程调用
if __name__ == '__main__':
do('example.com')
+2 -2
View File
@@ -22,7 +22,8 @@ class Riddler(Query):
if not resp:
return
subdomains_find = self.match(self.domain, resp.text)
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -47,5 +48,4 @@ def do(domain): # 统一入口名字 方便多线程调用
if __name__ == '__main__':
do('example.com')
+2 -1
View File
@@ -34,7 +34,8 @@ class Robtex(Query):
return
subdomains_find = self.match(self.domain, resp.text)
if subdomains_find:
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -25,10 +25,11 @@ class SecurityTrailsAPI(Query):
resp = self.get(url, params)
if not resp:
return
subdomains_prefix = resp.json()['subdomains']
subdomains_find = [f'{prefix}.{self.domain}' for prefix in subdomains_prefix]
prefixs = resp.json()['subdomains']
subdomains_find = [f'{prefix}.{self.domain}' for prefix in prefixs]
if subdomains_find:
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
def run(self):
"""
@@ -49,12 +50,10 @@ def do(domain): # 统一入口名字 方便多线程调用
类统一调用入口
:param str domain: 域名
"""
query = SecurityTrailsAPI(domain)
query.run()
if __name__ == '__main__':
do('example.com')
+4 -3
View File
@@ -29,8 +29,10 @@ class SiteDossier(Query):
subdomains_find = self.match(self.domain, resp.text)
if not subdomains_find: # 搜索没有发现子域名则停止搜索
break
self.subdomains = self.subdomains.union(subdomains_find) # 合并搜索子域名搜索结果
if 'Show next 100 items' not in resp.text: # 搜索页面没有出现下一页时停止搜索
# 合并搜索子域名搜索结果
self.subdomains = self.subdomains.union(subdomains_find)
# 搜索页面没有出现下一页时停止搜索
if 'Show next 100 items' not in resp.text:
break
self.page_num += self.per_page_num
@@ -57,5 +59,4 @@ def do(domain): # 统一入口名字 方便多线程调用
if __name__ == '__main__':
do('example.com')