簡單的流程化資訊收集

腳本

import os
import fnmatch
import socket
import shutil

def checkcdn(host):
    ip_list=[]
    try:
        addrs = socket.getaddrinfo(host, None)
        for item in addrs:
            if item[4][0] not in ip_list:
                ip_list.append(item[4][0])
        count_ip = len(ip_list)
        if count_ip > 1:
            return False
        elif count_ip == 1:
            return ip_list[0]
        else:
            return False
    except Exception as e:
        return False# 列印錯誤

print("by k1115h0t")
print("根域名放置在domians.txt中")
print("當前檔案夾下放置httpx")
os.system('subfinder/subfinder -dL domains.txt -all -o subfinder_subdomains.txt')
os.system('python3 oneforall/oneforall.py --targets domains.txt run')
oneforall_result=''
for f_name in os.listdir('oneforall/results'):
        if fnmatch.fnmatch(f_name, 'all*.txt'):
            oneforall_result='oneforall/results/'+f_name

# 讀取第一個文本檔案
with open(oneforall_result, 'r') as file1:
    content1 = file1.readlines()

# 讀取第二個文本檔案
with open('subfinder_subdomains.txt', 'r') as file2:
    content2 = file2.readlines()

# 合并兩個文本檔案
merged_content = content1 + content2

# 去重
unique_content = list(set(merged_content))

# 將去重后的內容寫入新的文本檔案
with open('subdomains.txt', 'w') as merged_file:
    merged_file.writelines(unique_content)

print("================================================")
print("================================================")
print("================================================")
print("子域名已經全部掃描完成，子域名結果存盤在 subdomains.txt")
print("開始識別CDN")
print("================================================")
print("================================================")
print("================================================")
if os.path.exists('oneforall/results'):
    shutil.rmtree(r'oneforall/results')
os.remove('subfinder_subdomains.txt')
f1=open(file='subdomains.txt',mode='r',encoding='utf-8')
f2=open(file='cdn.txt',mode='a',encoding='utf-8')
f3=open(file='nocdn.txt',mode='a',encoding='utf-8')
f4=open(file='nocdn_ip.txt',mode='a',encoding='utf-8')
l1=[]
num=1
for i in f1.readlines():
    newi=i.strip('\n')
    result=checkcdn(newi)
    # print(num)
    num=num+1
    if result!=False:
        f3.write(i)
        if result not in l1:
            l1.append(result)
    else:
        f2.write(i)
for j in l1:
    f4.write(j+'\n')
f1.close()
f2.close()
f3.close()
f4.close()
print("================================================")
print("================================================")
print("================================================")
print("cdn識別完成，結果存盤在 cdn.txt nocdn.txt nocdn_ip.txt")
print("開始呼叫httpx")
print("================================================")
print("================================================")
print("================================================")
os.system('./httpx -l cdn.txt -sc -cl -title -o cdn_httpx.txt')
os.system('./httpx -l nocdn.txt -sc -cl -title -o nocdn_httpx.txt')
print("================================================")
print("================================================")
print("================================================")
print("httpx識別完成，結果存盤在 cdn_httpx.txt nocdn_httpx.txt")
print("開始呼叫rustscan")
print("================================================")
print("================================================")
print("================================================")
os.system("rustscan -a nocdn_ip.txt -r 1-65535 -- -sC -Pn -n -sV >> rustscan_nocdn.txt")

使用時需要新建一個domains.txt用于存放根域名（baidu.com）

腳本的流程

1. 呼叫 subfinder 和 oneforall進行子域名掃描

   生成 subdomains.txt 存盤所有的子域名
   

2. 對子域名結果進行分析去重，并識別cdn

   生成 cdn.txt nocdn.txt nocdn_ip.txt
   

3. 使用httpx進行掃描

   生成 cdn_httpx.txt nocdn_httpx.txt
   

4. 使用rustscan對無cdn的ip進行埠掃描

   生成 rustscan_nocdn.txt
   

目錄下面工具的放置

在第二次使用的時候，需要先手動洗掉所有txt檔案

rm *.txt

目錄結構：

├── cdn_httpx.txt  有cdn的域名的httpx 結果
├── cdn.txt  沒有cdn的域名
├── domains.txt 要進行資訊收集的根域名
├── httpx	httpx二進制檔案
├── nocdn_httpx.txt 無cdn的域名的httpx 結果
├── nocdn_ip.txt	無cdn域名決議出的ip
├── nocdn.txt	
├── oneforall
├── rustscan_nocdn.txt
├── start.py
├── subdomains.txt
└── subfinder

工具鏈接

工具鏈接：
	https://github.com/shmilylty/OneForAll
	https://github.com/projectdiscovery/subfinder
	https://github.com/projectdiscovery/httpx
	https://github.com/RustScan/RustScan

標籤：其他

上一篇：如何在Solidity中建立DAO（去中心化自治組織）？

下一篇：XIAMEN_AMOY