#!/usr/bin/env python2
# -*- coding: latin-1 -*- ######################################################
# ____ _ __ #
# ___ __ __/ / /__ ___ ______ ______(_) /___ __ #
# / _ \/ // / / (_-</ -_) __/ // / __/ / __/ // / #
# /_//_/\_,_/_/_/___/\__/\__/\_,_/_/ /_/\__/\_, / #
# /___/ team #
# #
# dnsspider.py - multithreaded subdomain bruteforcer #
# #
# DATE #
# 08/16/2012 #
# #
# DESCRIPTION #
# A very fast multithreaded bruteforcer of subdomains that leverages a #
# wordlist and/or character permutation. #
# #
# AUTHOR #
# noptrix - http://www.nullsecurity.net/ #
# #
# NOTES: #
# quick'n'dirty code #
# #
# TODO: #
# - check if we have to scan if wildcard enabled #
# - attack while mutating -> don't generate whole list when using -t 1 #
# #
# CHANGELOG: #
# v0.7 #
# - upgraded built-in wordlist (more than 2k) #
# - remove annoying timeout warnings #
# - remove color output when logging to file #
# #
# v0.6 #
# - upgraded default wordlist #
# - replaced optionparser with argparse #
# - add version output option #
# - fixed typo #
# #
# v0.5 #
# - fixed extracted ip addresses from rrset answers #
# - renamed file (removed version string) #
# - removed trailing whitespaces #
# - removed color output #
# - changed banner #
# #
# v0.4 #
# - fixed a bug for returned list #
# - added postfix option #
# - upgraded wordlist[] #
# - colorised output #
# - changed error messages #
# #
# v0.3: #
# - added verbose/quiet mode - default is quiet now #
# - fixed try/catch for domainnames #
# - fixed some tab width (i normally use <= 80 chars per line) #
# #
# v0.2: #
# - append DNS and IP output to found list #
# - added diffound list for subdomains resolved to different addresses #
# - get right ip address from current used iface to avoid socket problems #
# - fixed socket exception syntax and output #
# - added usage note for fixed port and multithreaded socket exception #
# #
# v0.1: #
# - initial release #
################################################################################
import sys
import time
import string
import itertools
import socket
import threading
import re
import argparse
try:
import dns.message
import dns.query
except ImportError:
print("[-] ERROR: you need 'dnspython' package")
sys.exit()
BANNER = '--==[ dnsspider by noptrix@nullsecurity.net ]==--'
USAGE = '\n' \
' dnsspider.py -t <arg> -a <arg> [options]'
VERSION = 'v0.7'
defaults = {}
hostnames = []
prefix = ''
postfix = ''
found = []
diffound = []
chars = string.ascii_lowercase
digits = string.digits
# default wordlist
wordlist = [
'0', '01', '02', '03', '1', '10', '11', '12', '13', '14', '15', '16', '17',
'18', '19', '2', '20', '3', '3com', '4', '5', '6', '7', '8', '9', 'a', 'a01',
'a02', 'a1', 'a2', 'a.auth-ns', 'abc', 'about', 'abu', 'abuja', 'ac',
'academico', 'acceso', 'access', 'accounting', 'accounts', 'accra', 'acid',
'activestat', 'ad', 'adam', 'addis', 'adkit', 'adm', 'admin', 'administracion',
'administrador', 'administrator', 'administrators', 'admins', 'ads', 'adserver',
'adsl', 'ae', 'af', 'affiliate', 'affiliates', 'afiliados', 'ag', 'agenda',
'agent', 'ai', 'ain', 'aix', 'ajax', 'ak', 'akamai', 'al', 'alabama', 'alaska',
'albuquerque', 'alerts', 'algiers', 'alpha', 'alterwind', 'am', 'amarillo',
'americas', 'amman', 'amsterdam', 'an', 'anaheim', 'analyzer', 'andorra',
'ankara', 'announce', 'announcements', 'antananarivo', 'antivirus', 'ao', 'ap',
'apache', 'api', 'apia', 'apollo', 'app', 'app01', 'app1', 'apple',
'application', 'applications', 'apps', 'appserver', 'aq', 'ar', 'arch',
'archie', 'arcsight', 'argentina', 'arizona', 'arkansas', 'arlington', 'as',
'as400', 'ashgabat', 'asia', 'asmara', 'astana', 'asterix', 'asuncion', 'at',
'athena', 'athens', 'atlanta', 'atlas', 'att', 'au', 'auction', 'austin',
'auth', 'auto', 'autodiscover', 'autorun', 'av', 'aw', 'ayuda', 'az', 'b',
'b01', 'b02', 'b1', 'b2', 'b2b', 'b2c', 'ba', 'back', 'backend', 'backtrack',
'backup', 'backups', 'baghdad', 'baker', 'bakersfield', 'baku', 'balance',
'balancer', 'baltimore', 'bamako', 'bandar', 'bangkok', 'bangui', 'banjul',
'banking', 'basseterre', 'b.auth-ns', 'bayarea', 'bb', 'bbdd', 'bbs', 'bd',
'bdc', 'be', 'bea', 'beijing', 'beirut', 'belfast', 'belgrade', 'belmopan',
'berlin', 'bern', 'beta', 'bf', 'bg', 'bh', 'bi', 'bill', 'billing', 'bishkek',
'bissau', 'biz', 'biztalk', 'bj', 'black', 'blackberry', 'blackboard', 'blog',
'blogs', 'blue', 'bm', 'bn', 'bnc', 'bo', 'board', 'bob', 'bof', 'bogota',
'boise', 'bolsa', 'border', 'boston', 'boulder', 'boy', 'br', 'brasilia',
'bratislava', 'bravo', 'brazil', 'brazzaville', 'bridgetown', 'britian',
'broadcast', 'broker', 'bronze', 'brown', 'brussels', 'bs', 'bsc', 'bsd',
'bsd0', 'bsd01', 'bsd02', 'bsd1', 'bsd2', 'bsdi', 'bss', 'bt', 'bts',
'bucharest', 'budapest', 'buenos', 'bug', 'buggalo', 'bugs', 'bugzilla',
'build', 'bujumbura', 'bulletins', 'burn', 'burner', 'buscador', 'buy', 'bv',
'bw', 'by', 'bz', 'c', 'ca', 'cache', 'cafe', 'cairo', 'calendar', 'california',
'call', 'calvin', 'canada', 'canal', 'canberra', 'canon', 'caracas', 'cardiff',
'careers', 'cart', 'castries', 'catalog', 'catalogue', 'c.auth-ns', 'cayenne',
'cc', 'cd', 'cdburner', 'cdn', 'centos', 'central', 'cert', 'certificates',
'certify', 'certserv', 'certsrv', 'cf', 'cg', 'cgi', 'ch', 'channel',
'channels', 'charlie', 'charlotte', 'chat', 'chats', 'chatserver', 'check',
'checkpoint', 'chi', 'chicago', 'chimera', 'chisinau', 'chronos', 'ci', 'cims',
'cincinnati', 'cisco', 'citrix', 'ck', 'cl', 'class', 'classes', 'classifieds',
'classroom', 'cleveland', 'cli', 'clicktrack', 'client', 'clientes', 'clients',
'clix', 'club', 'clubs', 'cluster', 'clusters', 'cm', 'cmail', 'cms', 'cn',
'co', 'cocoa', 'code', 'coldfusion', 'colombo', 'colombus', 'colorado',
'columbus', 'com', 'commerce', 'commerceserver', 'communigate', 'community',
'compaq', 'compras', 'con', 'conakry', 'concentrator', 'conf', 'conference',
'conferencing', 'confidential', 'connect', 'connecticut', 'consola', 'console',
'consult', 'consultant', 'consultants', 'consulting', 'consumer', 'contact',
'content', 'contracts', 'control', 'controller', 'copenhagen', 'core', 'core0',
'core01', 'corp', 'corpmail', 'corporate', 'correo', 'correoweb', 'cortafuegos',
'counterstrike', 'courses', 'cpanel', 'cr', 'cricket', 'crm', 'crs', 'cs',
'cso', 'css', 'ct', 'cu', 'cust1', 'cust10', 'cust100', 'cust101', 'cust102',
'customer', 'customers', 'cv', 'cvs', 'cx', 'cy', 'cz', 'd', 'dakar', 'dallas',
'damascus', 'dar', 'darwin', 'data', 'database', 'database01', 'database02',
'database1', 'database2', 'databases', 'datastore', 'datos', 'david', 'db',
'db0', 'db01', 'db02', 'db1', 'db2', 'dc', 'de', 'dealers', 'debian', 'dec',
'def', 'default', 'defiant', 'delaware', 'dell', 'delta', 'delta1', 'demo',
'demon', 'demonstration', 'demos', 'denver', 'depot', 'des', 'desarrollo',
'descargas', 'design', 'designer', 'desktop', 'detroit', 'dev', 'dev0', 'dev01',
'dev1', 'devel', 'develop', 'developer', 'developers', 'development', 'device',
'devserver', 'devsql', 'dhaka', 'dhcp', 'dial', 'dialer', 'dialup', 'diana',
'digital', 'dilbert', 'dili', 'dir', 'direct', 'directory', 'disc', 'discovery',
'discuss', 'discussion', 'discussions', 'disk', 'disney', 'distributer',
'distributers', 'dj', 'djibouti', 'dk', 'dm', 'dmail', 'dmz', 'dnews', 'dns',
'dns0', 'dns1', 'dns2', 'dns-2', 'dns3', 'do', 'doc', 'docs', 'document',
'documentacion', 'documentos', 'doha', 'domain', 'domaincontroller',
'domain-controller', 'domains', 'dominio', 'domino', 'dominoweb', 'doom',
'download', 'downloads', 'downtown', 'dragon', 'dragonflybsd', 'drupal',
'dsl', 'dublin', 'dushanbe', 'dyn', 'dynamic', 'dynip', 'dz', 'e', 'e0',
'eaccess', 'eagle', 'earth', 'east', 'ec', 'echo', 'ecom', 'e-com', 'ecommerce',
'e-commerce', 'edi', 'edinburgh', 'edu', 'education', 'edward', 'ee', 'eg',
'eh', 'ejemplo', 'elpaso', 'email', 'employees', 'empresa', 'empresas', 'en',
'enable', 'eng', 'eng01', 'eng1', 'engine', 'engineer', 'engineering',
'enrutador', 'enterprise', 'epsilon', 'er', 'erp', 'es', 'esd', 'esm',
'espanol', 'estadisticas', 'esx', 'et', 'eta', 'europe', 'events', 'ex',
'example', 'examples', 'exchange', 'exec', 'exim', 'exit', 'ext', 'extern',
'external', 'extranet', 'f', 'f5', 'falcon', 'farm', 'faststats', 'fax',
'fedora', 'fedoracore', 'feedback', 'feeds', 'fi', 'field', 'file', 'files',
'fileserv', 'fileserver', 'filestore', 'filter', 'finance', 'find', 'finger',
'firewall', 'fix', 'fixes', 'fj', 'fk', 'fl', 'flash', 'florida', 'flow', 'fm',
'fo', 'foobar', 'formacion', 'foro', 'foros', 'fortworth', 'forum', 'forums',
'foto', 'fotos', 'foundry', 'fox', 'foxtrot', 'fr', 'france', 'frank', 'fred',
'freebsd', 'freebsd0', 'freebsd01', 'freebsd02', 'freebsd1', 'freebsd2',
'freetown', 'freeware', 'fresno', 'front', 'frontdesk', 'fs', 'fsp', 'ftp',
'ftp-', 'ftp0', 'ftp2', 'ftpd', 'ftpserver', 'fw', 'fw1', 'fw-1', 'fwsm',
'fwsm0', 'fwsm01', 'fwsm1', 'g', 'ga', 'gaborone', 'galeria', 'galerias',
'galleries', 'gallery', 'games', 'gamma', 'gandalf', 'gate', 'gatekeeper',
'gateway', 'gauss', 'gd', 'ge', 'gemini', 'general', 'gentoo', 'george',
'georgetown', 'georgia', 'germany', 'gf', 'gg', 'gh', 'gi', 'gilford', 'git',
'gl', 'glendale', 'gm', 'gmail', 'gn', 'go', 'gold', 'goldmine', 'golf',
'gopher', 'gp', 'gprs', 'gq', 'gr', 'green', 'group', 'groups', 'groupwise',
'gs', 'gsx', 'gt', 'gu', 'guatemala', 'guest', 'guide', 'gw', 'gw1', 'gy', 'h',
'hal', 'halflife', 'hanoi', 'harare', 'havana', 'hawaii', 'hello', 'help',
'helpdesk', 'helponline', 'helsinki', 'henry', 'hera', 'heracles', 'hercules',
'hermes', 'hi', 'hidden', 'hk', 'hm', 'hn', 'hobbes', 'hollywood', 'home',
'homebase', 'homer', 'honeypot', 'honiara', 'honolulu', 'host', 'host1',
'host3', 'host4', 'host5', 'hotel', 'hotjobs', 'hotspot', 'houstin', 'houston',
'howto', 'hp', 'hpc', 'hpov', 'hpux', 'hp-ux', 'hr', 'ht', 'http', 'https',
'hu', 'hub', 'humanresources', 'hypernova', 'i', 'ia', 'ias', 'ibm', 'ibmdb',
'id', 'ida', 'idaho', 'ids', 'ie', 'iis', 'il', 'illinois', 'ILMI', 'im',
'image', 'images', 'imail', 'imap', 'imap3', 'imap3d', 'imap4', 'imapd',
'imaps', 'img', 'img0', 'img01', 'img02', 'imgs', 'in', 'inbound', 'inc',
'include', 'incoming', 'india', 'indiana', 'indianapolis', 'info', 'informix',
'inside', 'install', 'int', 'interface', 'intern', 'internal', 'international',
'internet', 'intl', 'intranet', 'invalid', 'investor', 'investors', 'io',
'iota', 'iowa', 'ip', 'ip6', 'iplanet', 'ipmonitor', 'ipsec', 'ipsec-gw',
'ipsp', 'ipv6', 'iq', 'ir', 'irc', 'ircd', 'ircserver', 'ireland', 'iris',
'irix', 'irvine', 'irving', 'is', 'isa', 'isaserv', 'isaserver',
'islamabad', 'ism', 'israel', 'isync', 'it', 'italy', 'ix', 'j', 'jabber',
'jakarta', 'japan', 'java', 'jboss', 'je', 'jedi', 'jm', 'jo', 'jobs', 'john',
'jp', 'jrun', 'juba', 'juegos', 'juliet', 'juliette', 'juniper', 'jupiter', 'k',
'kabul', 'kampala', 'kansas', 'kansascity', 'kappa', 'kathmandu', 'kb', 'ke',
'kentucky', 'kerberos', 'keynote', 'kg', 'kh', 'khartoum', 'ki', 'kiev',
'kigali', 'kilo', 'king', 'kingston', 'kingstown', 'kinshasa', 'km', 'kn',
'knowledgebase', 'knoxville', 'koe', 'korea', 'kp', 'kr', 'ks', 'kuala',
'kuwait', 'kw', 'ky', 'kz', 'l', 'la', 'lab', 'laboratories', 'laboratory',
'labs', 'lambda', 'lan', 'laptop', 'laserjet', 'lasvegas', 'launch', 'lb', 'lc',
'ldap', 'legal', 'leo', 'li', 'lib', 'library', 'libreville', 'lilongwe',
'lima', 'lincoln', 'link', 'linux', 'linux0', 'linux01', 'linux02', 'linux1',
'linux2', 'lisa', 'lisbon', 'lista', 'lists', 'listserv', 'listserver', 'live',
'ljubljana', 'lk', 'load', 'loadbalancer', 'local', 'localhost', 'log', 'log0',
'log01', 'log02', 'log1', 'log2', 'logfile', 'logfiles', 'logger', 'logging',
'loghost', 'login', 'logon', 'logs', 'lome', 'london', 'longbeach',
'losangeles', 'lotus', 'louisiana', 'lr', 'ls', 'lt', 'lu', 'luanda', 'luke',
'lusaka', 'luxembourg', 'lv', 'ly', 'lyris', 'm', 'ma', 'mac', 'mac1', 'mac10',
'mac11', 'mac2', 'mac3', 'mac4', 'mac5', 'mach', 'macintosh', 'madrid', 'mail',
'mail2', 'mailer', 'mailgate', 'mailhost', 'mailing', 'maillist', 'maillists',
'mailroom', 'mailserv', 'mailsite', 'mailsrv', 'main', 'maine', 'maint',
'majuro', 'malabo', 'male', 'mall', 'manage', 'management', 'manager',
'managers', 'managua', 'manama', 'mandrake', 'mandriva', 'manila',
'manufacturing', 'map', 'mapas', 'maps', 'maputo', 'marketing', 'marketplace',
'mars', 'marvin', 'mary', 'maryland', 'maseru', 'massachusetts', 'master',
'max', 'mbabana', 'mc', 'mci', 'md', 'mdaemon', 'me', 'media', 'melekeok',
'member', 's', 'master', 'max', 'mbabana', 'mc', 'mci', 'md', 'mdaemon', 'me',
'media', 'melekeok', 'member', 'members', 'memphis', 'mercury', 'merlin',
'messages', 'messenger', 'meta', 'mexico', 'mg', 'mgc', 'mgmt', 'mh', 'mi',
'miami', 'michigan', 'mickey', 'midwest', 'mike', 'milwaukee', 'minerva',
'minneapolis', 'minnesota', 'minsk', 'mint', 'mirror', 'mis', 'mississippi',
'missouri', 'mk', 'ml', 'mm', 'mn', 'mngt', 'mo', 'mob', 'mobile', 'mogadishu',
'mom', 'monaco', 'monitor', 'monitoring', 'monrovia', 'montana', 'montevideo',
'moodle', 'moon', 'moroni', 'moscow', 'movies', 'mozart', 'mp', 'mp3', 'mpeg',
'mpg', 'mq', 'mr', 'mrtg', 'ms', 'msexchange', 'ms-exchange', 'mssql', 'ms-sql',
'mssql0', 'mssql01', 'mssql1', 'mt', 'mta', 'mtu', 'mu', 'multimedia', 'muscat',
'music', 'mv', 'mw', 'mx', 'mx01', 'my', 'mysql', 'mysql0', 'mysql01', 'mysql1',
'mz', 'n', 'na', 'nairobi', 'name', 'names', 'nameserv', 'nameserver', 'nas',
'nashville', 'nassau', 'nat', 'nc', 'nd', 'ndjamena', 'nds', 'ne', 'nebraska',
'nelson', 'neon', 'neptune', 'net', 'netapp', 'netbsd', 'netdata', 'netgear',
'netmail', 'netmeeting', 'netscaler', 'netscreen', 'netstats', 'netware',
'network', 'nevada', 'new', 'newhampshire', 'newjersey', 'newmexico',
'neworleans', 'news', 'newsfeed', 'newsfeeds', 'newsgroups', 'newton',
'newyork', 'newzealand', 'nf', 'ng', 'nh', 'ni', 'niamey', 'nicosia', 'nigeria',
'nj', 'nl', 'nm', 'nms', 'nntp', 'no', 'noc', 'node', 'nokia', 'nombres',
'nora', 'north', 'northcarolina', 'northdakota', 'northeast', 'northwest',
'noticias', 'nouakchott', 'novell', 'november', 'np', 'nr', 'ns', 'ns-', 'ns0',
'ns01', 'ns02', 'ns1', 'ns2', 'ns3', 'ns4', 'ns5', 'nt', 'nt4', 'nt40',
'ntmail', 'ntp', 'ntpd', 'ntserver', 'nu', 'nukualofa', 'null', 'nv', 'ny',
'nz', 'o', 'oakland', 'ocean', 'odin', 'office', 'offices', 'oh', 'ohio', 'ok',
'oklahoma', 'oklahomacity', 'old', 'om', 'omaha', 'omega', 'omicron', 'online',
'ontario', 'op', 'open', 'openbsc', 'openbsd', 'openbts', 'openserver',
'opensolaris', 'opensuse', 'openview', 'openvms', 'operations', 'ops', 'ops0',
'ops01', 'ops02', 'ops1', 'ops2', 'opsware', 'or', 'oracle', 'orange', 'order',
'orders', 'oregon', 'orion', 'orlando', 'os', 'os390', 'oscar', 'oslo', 'osx',
'ottawa', 'ouagadougou', 'out', 'outbound', 'outdial', 'outgoing', 'outlook',
'outside', 'ov', 'owa', 'owa01', 'owa02', 'owa1', 'owa2', 'ows', 'oxnard', 'p',
'pa', 'pad', 'page', 'pager', 'pages', 'paginas', 'palikir', 'panama', 'papa',
'paramaribo', 'paris', 'parners', 'partner', 'partners', 'patch', 'patches',
'paul', 'payroll', 'pbx', 'pc', 'pc01', 'pc1', 'pc10', 'pc101', 'pc11', 'pc12',
'pc13', 'pc14', 'pc15', 'pc16', 'pc17', 'pc18', 'pc19', 'pc2', 'pc20',
'pcanywhere', 'pcbsd', 'pcmail', 'pcu', 'pda', 'pdc', 'pe', 'pegasus',
'pendrell', 'pennsylvania', 'peoplesoft', 'personal', 'pf', 'pg', 'pgp', 'ph',
'phi', 'philadelphia', 'phnom', 'phoenix', 'phoeniz', 'phone', 'phones',
'photo', 'photos', 'phpmyadmin', 'pi', 'pics', 'pictures', 'pink', 'pipex-gw',
'pittsburgh', 'pix', 'pk', 'pki', 'pl', 'plano', 'platinum', 'plesk', 'pluto',
'pm', 'pm1', 'pma', 'pn', 'po', 'podgorica', 'policy', 'polls', 'pop', 'pop3',
'port', 'portal', 'portals', 'portfolio', 'portland', 'porto', 'post',
'postales', 'postgresql', 'postman', 'postmaster', 'postoffice', 'pp', 'ppp',
'ppp1', 'ppp10', 'ppp11', 'ppp12', 'ppp13', 'ppp14', 'ppp15', 'ppp16', 'ppp17',
'ppp18', 'ppp19', 'ppp2', 'ppp20', 'ppp21', 'ppp3', 'ppp4', 'ppp5', 'ppp6',
'ppp7', 'ppp8', 'ppp9', 'pptp', 'pr', 'prague', 'praia', 'pre', 'prensa',
'preprod', 'pre-prod', 'press', 'pretoria', 'printer', 'printserv',
'printserver', 'pristina', 'priv', 'privacy', 'private', 'problemtracker',
'prod', 'products', 'profiles', 'project', 'projects', 'promo', 'proxy',
'prueba', 'pruebas', 'ps', 'psi', 'pss', 'pt', 'pub', 'public', 'pubs',
'purple', 'pw', 'py', 'pyongyang', 'q', 'qa', 'qmail', 'qnx', 'qotd', 'quake',
'quebec', 'queen', 'quito', 'quotes', 'r', 'r01', 'r02', 'r1', 'r2', 'ra',
'rabat', 'rack', 'radio', 'radius', 'rangoon', 'rapidsite', 'raptor', 'ras',
'rc', 'rcs', 'rd', 're', 'read', 'realserver', 'recruiting', 'red', 'redhat',
'ref', 'reference', 'reg', 'register', 'registro', 'registry', 'regs', 'relay',
'release', 'rem', 'remote', 'remstats', 'report', 'reports', 'research',
'reseller', 'reserved', 'restricted', 'resumenes', 'reykjavik', 'rhel', 'rho',
'rhodeisland', 'ri', 'riga', 'ris', 'risc', 'riyadh', 'rmi', 'ro', 'robert',
'robinhood', 'rome', 'romeo', 'root', 'rose', 'roseau', 'route', 'router',
'router1', 'rs', 'rss', 'rtelnet', 'rtr', 'rtr01', 'rtr1', 'ru', 'rune', 'rw',
'rwhois', 's', 's1', 's2', 'sa', 'sabayon', 'sac', 'sacramento', 'sadmin',
'safe', 'saint', 'sales', 'saltlake', 'sam', 'sample', 'san', 'sanaa',
'sanantonio', 'sandbox', 'sandiego', 'sanfrancisco', 'sanjose', 'santiago',
'santo', 'sao', 'sarajevo', 'saskatchewan', 'saturn', 'sb', 'sbs', 'sc',
'scanner', 'schedules', 'sco', 'scotland', 'scotty', 'scp', 'sd', 'se',
'search', 'seattle', 'sec', 'secret', 'secure', 'secured', 'securid',
'security', 'sendmail', 'seoul', 'seri', 'serv', 'serv2', 'server', 'server1',
'servers', 'service', 'services', 'servicio', 'servidor', 'setup', 'sg', 'sgsn',
'sh', 'share', 'shared', 'sharepoint', 'shares', 'shareware', 'shipping',
'shop', 'shoppers', 'shopping', 'si', 'siebel', 'sierra', 'sigma', 'signin',
'signup', 'silver', 'sim', 'singapore', 'sip', 'sirius', 'site', 'sj', 'sk',
'skopje', 'skywalker', 'sl', 'slack', 'slackware', 'slmail', 'sm', 'smc', 'sms',
'smsc', 'smtp', 'smtphost', 'sn', 'sniffer', 'snmp', 'snmpd', 'snoopy', 'snort',
'so', 'socal', 'sofia', 'software', 'sol', 'solaris', 'solutions', 'soporte',
'source', 'sourcecode', 'sourcesafe', 'south', 'southcarolina', 'southdakota',
'southeast', 'southwest', 'spain', 'spam', 'spider', 'spiderman', 'splunk',
'spock', 'spokane', 'springfield', 'sprint', 'sqa', 'sql', 'sql0', 'sql01',
'sql1', 'sql7', 'sqlserver', 'squid', 'squirrel', 'squirrelmail', 'sr', 'srv',
'ss', 'ss7', 'ssh', 'ssl', 'ssl0', 'ssl01', 'ssl1', 'ssp', 'st', 'staff',
'stage', 'stage1', 'staging', 'start', 'stat', 'static', 'statistics', 'stats',
'stlouis', 'stock', 'stockholm', 'storage', 'store', 'storefront', 'stp',
'streaming', 'stronghold', 'strongmail', 'studio', 'submit', 'subversion',
'sun', 'sun0', 'sun01', 'sun02', 'sun1', 'sun2', 'superman', 'supplier',
'suppliers', 'support', 'suse', 'suva', 'sv', 'svn', 'sw', 'sw0', 'sw01', 'sw1',
'sweden', 'switch', 'switzerland', 'sy', 'sybase', 'sydney', 'sysadmin',
'sysback', 'syslog', 'syslogs', 'system', 'sz', 't', 'tacas', 'tacoma',
'taipei', 'taiwan', 'talk', 'tallinn', 'tampa', 'tango', 'tarawa', 'tashkent',
'tau', 'tbilisi', 'tc', 'tcl', 'td', 'team', 'tech', 'technology',
'techsupport', 'tegucigalpa', 'tehran', 'tel', 'telephone', 'telephony',
'telnet', 'temp', 'tennessee', 'terminal', 'terminalserver', 'termserv', 'test',
'test2k', 'testbed', 'testing', 'testlab', 'testlinux', 'tests', 'testserver',
'testsite', 'testsql', 'testxp', 'texas', 'tf', 'tftp', 'tg', 'th', 'thailand',
'theta', 'thimphu', 'thor', 'tienda', 'tiger', 'time', 'tirana', 'titan',
'tivoli', 'tj', 'tk', 'tm', 'tn', 'to', 'tokyo', 'toledo', 'tom', 'tool',
'tools', 'toplayer', 'toronto', 'tour', 'tp', 'tr', 'tracker', 'train',
'training', 'transfers', 'trinidad', 'trinity', 'tripoli', 'ts', 'ts1', 'tt',
'tucson', 'tulsa', 'tunis', 'tunnel', 'tv', 'tw', 'tx', 'tz', 'u', 'ua',
'ubuntu', 'uddi', 'ug', 'uk', 'ulaanbaatar', 'um', 'un', 'uniform', 'union',
'unitedkingdom', 'unitedstates', 'unix', 'unixware', 'update', 'updates',
'upload', 'uploads', 'ups', 'upsilon', 'uranus', 'urchin', 'us', 'usa',
'usenet', 'user', 'users', 'ut', 'utah', 'utilities', 'uy', 'uz', 'v', 'va',
'vader', 'vaduz', 'vaiaku', 'valletta', 'vantive', 'vatican', 'vault', 'vc',
've', 'vega', 'vegas', 'vend', 'vendors', 'venus', 'vermont', 'vg', 'vi',
'victor', 'victoria', 'video', 'videos', 'vienna', 'vientiane', 'viking',
'vilnius', 'violet', 'vip', 'virginia', 'virtual', 'vista', 'vm', 'vms',
'vmserver', 'vmware', 'vn', 'vnc', 'voice', 'voicemail', 'voip', 'voyager',
'vpn', 'vpn0', 'vpn01', 'vpn02', 'vpn1', 'vpn2', 'vt', 'vu', 'vz', 'w', 'w1',
'w2', 'w3', 'wa', 'wais', 'wallet', 'wam', 'wan', 'wap', 'warehouse', 'warsaw',
'washington', 'wc3', 'web', 'webaccess', 'webadmin', 'webalizer', 'webboard',
'webcache', 'webcam', 'webcast', 'webct', 'webdev', 'webdocs', 'webfarm',
'webhelp', 'weblib', 'weblog', 'weblogic', 'webmail', 'webmaster', 'webmin',
'webproxy', 'webring', 'webs', 'webserv', 'webserver', 'webservices', 'webshop',
'website', 'websites', 'websphere', 'websrv', 'websrvr', 'webstats', 'webstore',
'websvr', 'webtrends', 'welcome', 'wellington', 'west', 'westvirginia', 'wf',
'whiskey', 'white', 'whois', 'wi', 'wichita', 'wiki', 'wililiam', 'win',
'win01', 'win02', 'win1', 'win2', 'win2000', 'win2003', 'win2k', 'win2k3',
'windhoek', 'windows', 'windows01', 'windows02', 'windows1', 'windows2',
'windows2000', 'windows2003', 'windowsxp', 'wingate', 'winnt', 'winproxy',
'wins', 'winserve', 'winxp', 'wire', 'wireless', 'wisconsin', 'wlan',
'wordpress', 'work', 'workstation', 'world', 'wpad', 'write', 'ws', 'ws1',
'ws10', 'ws11', 'ws12', 'ws13', 'ws2', 'ws3', 'ws4', 'ws5', 'ws6', 'ws7', 'ws8',
'ws9', 'wusage', 'wv', 'ww', 'www', 'www-', 'www0', 'www01', 'www-01', 'www02',
'www-02', 'www1', 'www-1', 'www2', 'www-2', 'www3', 'wwwchat', 'wwwdev',
'www-int', 'wwwmail', 'wy', 'wyoming', 'x', 'x25', 'x25gw', 'x25pad', 'xanthus',
'xi', 'xlogan', 'xmail', 'xml', 'xot', 'xp', 'x-ray', 'y', 'yamoussoukro',
'yankee', 'yaounde', 'ye', 'yellow', 'yerevan', 'young', 'yt', 'yu', 'z', 'za',
'zagreb', 'zebra', 'zenwalk', 'zera', 'zeus', 'zlog', 'z-log', 'zm', 'zos',
'zulu', 'zvm', 'zvse', 'zw'
]
def usage():
print('\n' + USAGE)
sys.exit()
return
def check_usage():
if len(sys.argv) == 1:
print('[!] WARNING: use -H for help and usage')
sys.exit()
return
def get_default_nameserver():
print('[+] getting default nameserver')
lines = list(open('/etc/resolv.conf', 'r'))
for line in lines:
line = string.strip(line)
if not line or line[0] == ';' or line[0] == '#':
continue
fields = string.split(line)
if len(fields) < 2:
continue
if fields[0] == 'nameserver':
defaults['nameserver'] = fields[1]
return defaults
def get_default_source_ip():
print('[+] getting default ip address')
try:
# get current used iface enstablishing temp socket
ipsocket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
ipsocket.connect(("gmail.com", 80))
defaults['ipaddr'] = ipsocket.getsockname()[0]
print('[+] found currently used interface ip ' + "'" +
defaults['ipaddr'] + "'")
ipsocket.close()
except:
print(''' [!] WARNING: can\'t get your ip-address, use "-i" option and
define yourself''')
return defaults
def parse_cmdline():
p = argparse.ArgumentParser(usage=USAGE, add_help=False)
p.add_argument(
'-t',
metavar='<type>',
dest='type',
help='attack type (0 for dictionary 1 for bruteforce)'
)
p.add_argument(
'-a',
metavar='<domain>',
dest='domain',
help='subdomain to bruteforce'
)
p.add_argument(
'-l',
metavar='<wordlist>',
dest='wordlist',
help='wordlist, one hostname per line (default: built-in)'
)
p.add_argument(
'-d',
metavar='<nameserver>',
dest='dnshost',
help="choose another nameserver (default: your system's)"
)
p.add_argument(
'-i',
metavar='<ipaddr>',
dest='ipaddr',
help="source ip address to use (default: your system's)"
)
p.add_argument(
'-p',
metavar='<port>',
dest='port',
default=0,
help='source port to use (default: 0 --> first free random port)'
)
p.add_argument(
'-u',
metavar='<protocol>',
dest='protocol',
default='udp',
help='speak via udp or tcp (default: udp)'
)
p.add_argument(
'-c',
metavar='<charset>',
dest='charset',
default=0,
help='choose charset 0 [a-z0-9], 1 [a-z] or 2 [0-9] (default: 0)'
)
p.add_argument(
'-m',
metavar='<maxchar>',
dest='max',
default=2,
help='max chars to bruteforce (default: 2)'
)
p.add_argument(
'-s',
metavar='<prefix>',
dest='prefix',
help="prefix for bruteforce, e.g. 'www'"
)
p.add_argument(
'-g',
metavar='<postfix>',
dest='postfix',
help="postfix for bruteforce, e.g. 'www'"
)
p.add_argument(
'-o',
metavar='<sec>',
dest='timeout',
default=3,
help='timeout (default: 3)'
)
p.add_argument(
'-v',
action='store_true',
dest='verbose',
help='verbose mode - prints every attempt (default: quiet)'
)
p.add_argument(
'-w',
metavar='<sec>',
dest='wait',
default=0,
help='seconds to wait for next request (default: 0)'
)
p.add_argument(
'-x',
metavar='<num>',
dest='threads',
default=32,
help='number of threads to use (default: 32) - choose more :)'
)
p.add_argument(
'-r',
metavar='<logfile>',
dest='logfile',
default='stdout',
help='write found subdomains to file (default: stdout)'
)
p.add_argument(
'-V',
action='version',
version='%(prog)s ' + VERSION,
help='print version information'
)
p.add_argument(
'-H',
action='help',
help='print this help'
)
return(p.parse_args())
def check_cmdline(opts):
if not opts.type or not opts.domain:
print('[-] ERROR: mount /dev/brain')
sys.exit()
return
def set_opts(defaults, opts):
if not opts.dnshost:
opts.dnshost = defaults['nameserver']
if not opts.ipaddr:
opts.ipaddr = defaults['ipaddr']
if int(opts.charset) == 0:
opts.charset = chars + digits
elif int(opts.charset) == 1:
opts.charset = chars
else:
opts.charset = digits
if not opts.prefix:
opts.prefix = prefix
if not opts.postfix:
opts.postfix = postfix
return opts
def read_hostnames(opts):
print('[+] reading hostnames')
hostnames = []
if opts.wordlist:
hostnames = list(open(opts.wordlist, 'r'))
return hostnames
else:
return wordlist
def attack(opts, hostname, attack_pool):
if opts.verbose:
sys.stdout.write(' -> trying %s\n' % hostname)
sys.stdout.flush()
try:
x = dns.message.make_query(hostname, 1)
if opts.protocol == 'udp':
a = dns.query.udp(x, opts.dnshost, float(opts.timeout), 53, None,
opts.ipaddr, int(opts.port), True, False)
else:
a = dns.query.tcp(x, opts.dnshost, float(opts.timeout), 53, None,
opts.ipaddr, int(opts.port), False)
attack_pool.release()
except dns.exception.Timeout:
sys.exit()
except socket.error:
print('''[-] ERROR: no connection? ip|srcport incorrectly defined? you
can run only one thread if fixed source port specified!''')
sys.exit()
if a.answer:
answ = ''
# iterate dns rrset answer (can be multiple sets) field to extract
# detailed info (dns and ip)
for i in a.answer:
answ += str(i[0])
answ += ' '
answer = (hostname, answ)
found.append(answer)
else:
pass
return
def str_gen(opts, hostnames):
print('[+] generating list of strings')
tmp_hostnames = itertools.product(opts.charset, repeat=int(opts.max))
hostnames = list(tmp_hostnames)
hostnames = map(''.join, hostnames)
return hostnames
def run_threads(opts, hostname, attack_pool, threads):
t = threading.Thread(target=attack, args=(opts, hostname, attack_pool))
attack_pool.acquire()
t.start()
threads.append(t)
return threads
def prepare_attack(opts, hostnames):
sys.stdout.write('[+] attacking \'%s\' via ' % opts.domain)
threads = list()
attack_pool = threading.BoundedSemaphore(value=int(opts.threads))
if opts.type == '0':
sys.stdout.write('dictionary\n')
for hostname in hostnames:
hostname = hostname.rstrip() + '.' + opts.domain
time.sleep(float(opts.wait))
threads = run_threads(opts, hostname, attack_pool, threads)
for t in threads:
t.join()
elif opts.type == '1':
sys.stdout.write('bruteforce\n')
hostnames = str_gen(opts, hostnames)
for hostname in hostnames:
hostname = opts.prefix + hostname + opts.postfix + '.' + opts.domain
time.sleep(float(opts.wait))
threads = run_threads(opts, hostname, attack_pool, threads)
for t in threads:
t.join()
else:
print('[-] ERROR: unknown attack type')
sys.exit()
return
def ip_extractor(ip):
#extract ip from string of rrset answer object
try:
extracted = re.findall(r'[0-9]+(?:\.[0-9]+){3}', ip)
return extracted[0]
except:
print('[-] ERROR: can\'t extract ip addresses')
sys.exit()
def analyze_results(opts, found):
#get maindomain ip
try:
mainhostip = socket.gethostbyname(opts.domain)
#append domain|ip to diffound if subdomain ip different than starting
# domain ip
([diffound.append(domain + ' | ' + ip)
for domain, ip in found if ip_extractor(ip) != mainhostip])
except dns.exception.Timeout:
sys.exit()
except socket.error:
print('[-] ERROR: wrong domain or no connection?')
sys.exit()
return
def log_results(opts, found, diffound):
if opts.logfile == 'stdout':
print('---')
if not found:
print('no hosts found :(')
else:
print('ANSWERED DNS REQUESTS')
print('---')
for f in found:
print(f[0] + ' | ' + f[1])
if not diffound:
print('---')
print('NO HOSTS WITH DIFFERENT IP FOUND :(')
else:
print('---')
print('ANSWERED DNS REQUEST WITH DIFFERENT IP')
print('---')
for domain in diffound:
print(domain)
else:
print('[+] logging results to %s' % opts.logfile)
with open(opts.logfile, 'w') as f:
if found:
f.write('---\n')
f.write('ANSWERED DNS REQUESTS\n')
f.write('---\n')
for x in found:
f.write('domain: ' + x[0] + ' | ' + x[1] + '\n')
if not diffound:
f.write('---\nNO HOSTS WITH DIFFERENT IP FOUND :(\n')
else:
f.write('---\nANSWERED DNS REQUEST WITH DIFFERENT IP\n---\n')
for domain in diffound:
f.write('domain: ' + domain + '\n')
f.close()
print('[+] game over')
return
def main():
check_usage()
opts = parse_cmdline()
check_cmdline(opts)
if not opts.dnshost:
defaults = get_default_nameserver()
if not opts.ipaddr:
defaults = get_default_source_ip()
if opts.protocol != 'udp' and opts.protocol != 'tcp':
print('[-] ERROR: unknown protocol')
sys.exit(1337)
opts = set_opts(defaults, opts)
hostnames = read_hostnames(opts)
prepare_attack(opts, hostnames)
analyze_results(opts, found)
log_results(opts, found, diffound)
return
if __name__ == '__main__':
try:
print(BANNER + '\n')
main()
except KeyboardInterrupt:
print('\n[!] WARNING: aborted by user')
raise SystemExit
# EOF
0 komentar:
Post a Comment
I just a newbie and student, don't using this article for criminal