-
Notifications
You must be signed in to change notification settings - Fork 30
/
bing-ip2hosts
executable file
·447 lines (371 loc) · 12.5 KB
/
bing-ip2hosts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
#!/bin/bash
#
# bing-ip2hosts - Enumerate hostnames from Bing.com for an IP address.
# Bing.com is Microsoft's search engine which has an IP: search parameter.
#
# Copyright (C) 2009 - 2020 Andrew Horton aka urbanadventurer
# Homepage: http://www.morningstarsecurity.com/research/bing-ip2hosts
#
# License: GPLv3
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 3 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
VERSION=1.0.5
TMP_DIR="${TMPDIR:-/tmp}"
QUIET=0
OUTPUT_IP=0
DISPLAY_URL_PREFIX=1
IP=
PREFIX=
DEBUG=1
STOP_AFTER_PAGES=5
BING_SETLANG=en-us
BING_SETMKT=
UNAME=$(uname)
USER_AGENT="Wget/1.20 (linux-gnu)" # Bing responds differently to wget version 1.20+
N="\033[0;0m" #NORMAL
W="\033[0;97m" #WHITE
R="\033[0;31m" #RED
DR="\033[1;31m" #DARKRED
G="\033[0;32m" #GREEN
Y="\033[1;33m" #YELLOW
B="\033[0;34m" #BLUE
DG="\033[1;30m" #DARKGRAY
REVERSED="\033[1;7m" #REVERSED
trap ctrl_c INT
function ctrl_c() {
echo -e "\n* Stopping after user pressed CTRL-C."
# clean up tmp files
if [[ $DEBUG == 0 ]]; then
rm -f "$f_scraped_html"
fi
show_hosts
exit 1
}
function dependency_check() {
if [[ "$(which wget)" == "" ]]; then
echo "This script requires wget, please resolve and try again."
if [[ $UNAME == "Darwin" ]]; then
echo "Try: brew install wget"
fi
exit 1
fi
}
function banner() {
BANNER="
$G m, $N .,recon:, ,,
$G ##### $N ]##\"\"^^\"%##m %##b
$G ####b $N ]## \`##b
$G ####b $N ]## ## i## @#b,######m ,######m ##b
$G ####b 1mw, $N ]##MMM#### i## ]###\` %## ###\` \`@##
$G ####b 1#####Nw, $N ]##\`\` @#b i## ]## ### ### j##
$G ####i %########[$N ]## @## i## ]## ### ##g j##
$G ####n 2#####[$N ]## @## i## ]## ### @## {##
$G ####g ,#########b$N ]## ,,e### j## ]## ### 7##m,,,s#M##
$G #############M^ $N 'WWWWWW%b^ ii 'nn nn* \`1337\` g##
$G ##########\" $N G##
$G \"%##\" $N @#Gmmem###G
,i $G ,s2e, $N ## \`\`\`\`
\` $G \"\` %#$N ## T#
]# ]#,#M5@#p $G #b $N #H#H%@# s#M5O#o ,#MSSM W@##W= s#SSW
]# j#p ^#p$G ,#M $N ## @# ##' 'O# S#, ]# #b
]# j# #M$G ,#M $N ## @# #o O# \"SXm ]# ^\"@#
]# j##, ,## $G ,#2 $N ## @# 7#. .#O , ]# ]#Q ,#s
]# j######' $G #######x $N ## @# s#####o ####^ #Tt ####^
j#
$N j# $W bing-ip2hosts ($VERSION) by Andrew Horton @urbanadventurer
$N j# $W https://morningstarsecurity.com/research/bing-ip2hosts
$N $W https://github.com/urbanadventurer/bing-ip2hosts$N"
echo -e "$BANNER"
}
function display_progress() {
tput_cols=$(tput cols)
maxwidth_url=$((tput_cols - 6))
unset urlpath_truncated
if [[ ${#urlpath} -gt $maxwidth_url ]]; then
urlpath_truncated="${urlpath:0:$maxwidth_url}"
fi
tput_lines=$(tput lines)
max_vhosts=$(( tput_lines - 15))
vhosts_truncated=$( echo "$vhosts" | head -$max_vhosts )
highlight_paginated_links="${paginated_links/$paginated_current_link/${G}${REVERSED}$paginated_current_link${N}}"
PROGRESS="$G m, $DG -----.--[$N bing-ip2hosts v$VERSION $DG]-------------------------
$G ##### $DG | $N Searching : $IP
$G ####b $DG | $N$Y Found : $uniq_hosts
$G ####b $DG | $N Scraped pages: $page
$G ####b 1mw, $DG | $N
$G ####b 1#####Nw, $DG | $N Page Title : $page_title
$G ####i %########[$DG | $N Results : $results_count
$G ####n 2#####[$DG | $N Pagination : $highlight_paginated_links
$G ####g ,#########b$DG | $N New : $new_results new
$G #############M^ $DG | $N
$G ##########\" $DG | $N $extra_status_update
$G \"%##\" $DG | $N CTRL-C to stop
${N}[ ] /${urlpath_truncated:-$urlpath}"
#progress_animation="⣾⣽⣻⢿⡿⣟⣯⣷"
progress_animation="▏▎▍▌▋▊▉█▊▋▌▍▎"
clear
echo -e "$PROGRESS"
echo -e "${B}$vhosts_truncated${N}"
x=$((page % 13))
tput cup 13 1
echo -e "$DR${progress_animation:$x:1}"
tput cup 24 0
}
function show_hosts() {
local suffix=""
# sort by hostname. ignore URL prefix
if [[ $DISPLAY_URL_PREFIX == 1 ]]; then
uniq_hosts=$(sort -u -t '/' -k 3 < "$f_results")
else
uniq_hosts=$(sort -u < "$f_results")
fi
count_uniq_hosts=$(sort < "$f_results" | uniq | wc -l | tr -d ' ')
if [[ $DEBUG == 0 ]]; then
rm -f "$f_results"
fi
if [[ $OUTPUT_IP == 1 ]]; then
PREFIX="$IP,"
fi
if [[ $DISPLAY_URL_PREFIX == 1 ]]; then
suffix="/"
fi
echo -en "$N"
for h in $uniq_hosts
do
echo "$PREFIX$h$suffix"
done
if [[ -n "$OUTPUT_FILE" ]]; then
for h in $uniq_hosts
do
echo "$PREFIX$h$suffix" >> "$OUTPUT_FILE"
done
fi
if [[ $QUIET == 0 ]]; then
echo -e "\n${G}✓${N} Found ${Y}$count_uniq_hosts ${N}results after scraping ${Y}$page ${N}pages."
echo
fi
}
function validate_target(){
# if the parameter looks like an IP go ahead, otherwise resolve it
if [[ "$1" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
ret="$1"
else
ret=$(nslookup "$1" | grep -E "^Address: \w+\.\w+\.\w+\.\w+$" | tail -1 | awk '{ print $2 }')
if [ "$ret" == "" ]; then
echo "Cannot resolve $1 to an IP address." >&2
fi
fi
}
function scrape_ip(){
target="$1"
page=1
last_page_check=
results_count=
uniq_hosts=0
single_page=
results_removed=
extra_status_update=
declare -a scrape_results
f_results=$(mktemp -p "$TMP_DIR" -t bing-ip2hosts.tmp.XXXXXX 2>/dev/null || mktemp "$TMP_DIR"/bing-ip2hosts.tmp.XXXXXX)
validate_target "$target"
IP="$ret"
if [[ -z "$IP" ]]; then
return 1
fi
while true; do
url="https://www.bing.com/search?q=ip%3A$IP+.&qs=n&first=$((page-1))0&FORM=PERE&setlang=$BING_SETLANG&setmkt=$BING_SETMKT"
urlpath=$(echo "$url" | cut -d '/' -f 4-)
if [[ $page == 1 ]] && [[ $QUIET == 0 ]]; then
display_progress
fi
f_scraped_html=$(mktemp -p "$TMP_DIR" -t bing-ip2hosts.tmp.XXXXXX 2>/dev/null || mktemp "$TMP_DIR"/bing-ip2hosts.tmp.XXXXXX)
if ! wget --quiet --no-check-certificate --user-agent "$USER_AGENT" --output-document "$f_scraped_html" "$url"; then
echo -e "\n${R}wget failed to scrape $url" >&2
exit 1
fi
last_page_check=$(grep -E -o '<span class="sb_count">[0-9]+-([0-9]+) of (\1) results' "$f_scraped_html")
results_count=$(grep -E -o '<span class="sb_count">[^<]+' "$f_scraped_html" |cut -d '>' -f 2|cut -d ' ' -f 1-3)
single_page=$(grep -E -o '<span class="sb_count">[0-9] results' "$f_scraped_html")
results_removed=$(grep -E -o '>Some results have been removed<' "$f_scraped_html")
page_title=$(grep -E -o '<title>([^<]+)' "$f_scraped_html" | cut -d '>' -f 2)
paginated_current_link=$(grep -E -o "class=\"sb_pagS[^>]+sb_bp\">([0-9]+)" "$f_scraped_html" | cut -d '>' -f 2)
paginated_links=$(grep -E -o "<h4 class=\"b_hide\">Pagination</h4>.*?/nav" "$f_scraped_html" | grep -E -o ">([0-9\.]+)</a" | grep -E -o "[0-9\.]+" | tr '\n' ' ')
results=$(grep -E -o "<h2><a href=\"[^\"]+" "$f_scraped_html" | cut -d '"' -f 2)
if [[ $DISPLAY_URL_PREFIX == 1 ]]; then
vhosts=$(echo "$results" | cut -d '/' -f 1-3)
else
vhosts=$(echo "$results" | cut -d '/' -f 3)
fi
if [[ $UNAME == "Darwin" ]]; then
vhosts=$(echo "$vhosts" | tr '[:upper:]' '[:lower:]' ) # macOS has an old version of Bash
else
vhosts="${vhosts,,}" # convert to lowercase in pure Bash
fi
echo -e "$vhosts" >> "$f_results"
old_uniq_hosts=$uniq_hosts
uniq_hosts=$(sort < "$f_results"| uniq | wc -l | tr -d ' ')
# how many new results did we get
new_results=$(( uniq_hosts - old_uniq_hosts ))
scrape_results+=("$new_results")
if [[ $QUIET == 0 ]]; then
extra_status_update=""
if [ -n "$results_removed" ]; then
extra_status_update="${R}Some results have been removed"
fi
display_progress
fi
# clean up tmp files
if [[ $DEBUG == 0 ]]; then
rm -f "$f_scraped_html"
fi
# check end conditions
if [[ -n "$last_page_check" ]]; then
if [[ $QUIET == 0 ]]; then
echo -e "\n${R}Stopping. This is the last page of results." >&2
fi
break
fi
if [[ -z "$results_count" ]]; then
if [[ $QUIET == 0 ]]; then
echo -e "\n${R}Stopping. The search results count is missing." >&2
fi
break
fi
if [[ -n "$single_page" ]]; then
if [[ $QUIET == 0 ]]; then
echo -e "\n${R}Stopping. Returned only one page of results." >&2
fi
break
fi
if [[ ${scrape_results[*]} =~ $stop_sequence ]]; then
if [[ $QUIET == 0 ]]; then
echo -e "\n${R}Stopping after scraping $STOP_AFTER_PAGES pages without any new results.$N" >&2
fi
break
fi
(( page += 1 ))
done
}
function repeat_zero() {
how_many="$1"
local str="0"
for ((i = 0; i < ((how_many-1)); i++)); do str+=" 0"; done
echo "$str"
}
function usage()
{
clear
banner
if [[ $(tput lines) -ge 24 ]] && [[ $(tput lines) -le 26 ]]; then
# show the banner only in an 80x24 default terminal
echo -n "[Press Enter]"
read -r
else
echo
fi
echo -e "bing-ip2hosts is a Bing.com web scraper that discovers websites by IP address.
Use for OSINT and discovering attack-surface of penetration test targets.
Usage: $0 [OPTIONS] IP|hostname
OPTIONS are:
-o FILE\tOutput hostnames to FILE.
-i FILE\tInput list of IP addresses or hostnames from FILE.
-n NUM\tStop after NUM scraped pages return no new results (Default: $STOP_AFTER_PAGES).
-l\tSelect the language for use in the setlang parameter (Default: $BING_SETLANG).
-m\tSelect the market for use in the setmkt parameter (Default is unset).
-u\tOnly display hostnames. Default is to include URL prefixes.
-c\tCSV output. Outputs the IP and hostname on each line, separated by a comma.
-q\tQuiet. Disable output except for final results.
-t DIR\tUse this directory instead of /tmp.
-V\tDisplay the version number of bing-ip2hosts and exit.
"
dependency_check
exit 1
}
if [[ -z "$1" ]] || [[ "$1" == "-h" ]] || [[ "$1" == "--help" ]]; then
usage
fi
dependency_check
while getopts "i:o:n:l:m:ucqt:V" optionName; do
case "$optionName" in
i) INPUT_FILE=$OPTARG;;
o) OUTPUT_FILE=$OPTARG;;
n) STOP_AFTER_PAGES=$OPTARG;;
l) BING_SETLANG="$OPTARG";;
m) BING_SETMKT="$OPTARG";;
u) DISPLAY_URL_PREFIX=0;;
c) OUTPUT_IP=1;;
q) QUIET=1;;
t) TMP_DIR="$OPTARG";;
V) echo "bing-ip2hosts v$VERSION"; exit;;
[?]) echo "Error"; exit 1;;
esac
done
shift $((OPTIND -1))
if [[ -z "$1" ]] && [[ -z "$INPUT_FILE" ]]; then
echo "Missing IP address or hostname." >&2
exit 1
fi
if [[ -n "$INPUT_FILE" ]]; then
if [[ ! -r "$INPUT_FILE" ]]; then
echo "Cannot read from $INPUT_FILE." >&2
exit 1
fi
fi
# initialize outputfile
if [[ -n "$OUTPUT_FILE" ]]; then
touch "$OUTPUT_FILE"
if [[ ! -w "$OUTPUT_FILE" ]]; then
echo "Cannot write to $OUTPUT_FILE." >&2
exit 1
fi
fi
# Create TMP_DIR if necessary
if [[ ! -d "$TMP_DIR" ]]; then
if [[ "$QUIET" == 0 ]]; then
mkdir -v -p "$TMP_DIR"
else
mkdir -p "$TMP_DIR"
fi
if [[ ! "$?" == 0 ]]; then
echo "Invalid TMP Directory: $TMP_DIR." >&2
exit 1
fi
fi
if [[ $QUIET == 0 ]]; then
clear
fi
stop_sequence=$(repeat_zero "$STOP_AFTER_PAGES")
if [[ -n "$INPUT_FILE" ]]; then
declare -a result_files
declare -a result_ips
declare -a result_pages
while read -r target
do
scrape_ip "$target"
# copy $f_results
result_files+=("$f_results")
result_ips+=("$IP")
result_pages+=("$page")
done < "$INPUT_FILE"
# report on each result
for (( i=0; i < ${#result_files[@]}; i++)); do
f_results=${result_files[i]}
IP=${result_ips[i]}
page=${result_pages[i]}
show_hosts
done
else
target="$1"
scrape_ip "$target"
show_hosts
fi