-
Notifications
You must be signed in to change notification settings - Fork 2
/
x0r3r0xf_recon.sh
172 lines (119 loc) · 5.64 KB
/
x0r3r0xf_recon.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
#!/bin/bash
cat << "EOF"
I need a little cuddle..
- AissaM3kky
EOF
### Dirs Preparing..
main_domains=$1
sudo mkdir ./results
sudo mkdir ./results/tools
### End Dirs Preparing
for domain in $(cat $main_domains)
do
### Start Passive Recon
printf "
\e[96m##################################################\e[0m
\e[96mWill Start Retrieving Subdomains From hackertarget On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
curl --silent --insecure "https://api.hackertarget.com/hostsearch/?q=$domain" | cut -d "," -f 1 >> ./results/tools/apis_subdomain.txt
printf "
\e[96m##################################################\e[0m
\e[96mWill Start Retrieving Subdomains From threatcrowd On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
curl --silent --insecure "https://www.threatcrowd.org/searchApi/v2/domain/report/?domain=$domain" | grep -oE "[a-zA-Z0-9._-]+\.$domain" | tee ./results/tools/apis_subdomain.txt
printf "
\e[96m##################################################\e[0m
\e[96mWill Start Retrieving Subdomains From Crtsh On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
python3 /home/x0r3r0xf/tools/crtsh/crtsh.py -d $domain >> ./results/tools/apis_subdomain.txt
printf "
\e[96m##################################################\e[0m
\e[96mWorking With Amass [Enum-Passive] Mode.. On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
amass enum -passive -norecursive -noalts -d $domain -o ./results/tools/amass_enum.txt
printf "
\e[96m##################################################\e[0m
\e[96mWorking With Amass [Intel-Reverse Whois] Mode.. On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
#amass intel -whois -d $domain -o ./results/tools/amass_intel.md
### End Passive Recon
### Start Active Recon
printf "
\e[96m##################################################\e[0m
\e[96mWorking With Sublist3r .. On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
python3 /home/x0r3r0xf/tools/Sublist3r/sublist3r.py -d $domain -v -o ./results/tools/sublist3r_subdomains.txt
printf "
\e[96m##################################################\e[0m
\e[96mWorking With Findomain .. On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
/home/x0r3r0xf/tools/findomain --quiet --target $domain -o
cat ./$domain.txt | sort -u | uniq | uro >> ./results/tools/findomain_subdomains2.txt
rm -rf ./$domain.txt
cat ./results/tools/findomain_subdomains2.txt | sed 's/:\/\///' >> ./results/tools/findomain_subdomains.txt
rm -rf ./results/tools/findomain_subdomains2.txt
printf "
\e[96m##################################################\e[0m
\e[96mWorking With Subfinder .. On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
/home/x0r3r0xf/tools/subfinder -d $domain -o "./results/tools/subfinder_subdomains.txt"
printf "
\e[96m##################################################\e[0m
\e[96mBruteForcing Subdomain With GoBuster .. On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
/home/x0r3r0xf/go/bin/gobuster dns -d $domain -w /home/x0r3r0xf/wordlist/subdomain_5000.txt -o "./results/tools/gobuster_subdomains2.txt"
cat ./results/tools/gobuster_subdomains2.txt | cut -d " " -f 2 >> ./results/tools/gobuster_subdomains.txt
rm -rf ./results/tools/gobuster_subdomains2.txt
printf "
\e[96m##################################################\e[0m
\e[96mWorking With Knockpy .. On\e[0m \e[31m$domain\e[0m
\e[96m##################################################\e[0m
"
#sudo mkdir -p ./results/tools/$domain-knockpy-fast/
#sudo chmod 777 ./results/tools$domain-knockpy-fast/
#python3 /home/x0r3r0xf/tools/knock/knockpy.py $domain --no-http -o ./results/tools/$domain-knockpy-fast/
#mkdir -p ./results/tools/$domain-knockpy-deep/
#chmod 777 ./results/tools/$domain-knockpy-deep/
#knockpy $domain -o ./results/tools/$domain-knockpy-deep/
### End Active Recon
done
printf "
\e[96m##################################################\e[0m
\e[96m Sorting and Unique Subdomains... \e[0m \e[31m\e[0m
\e[96m##################################################\e[0m
"
cat ./results/tools/*.txt | sort -u | uniq > ./results/all_subdomains.txt
printf "
\e[96m##################################################\e[0m
\e[96m Make Wordlist for subdomain bruteforcing ... \e[0m \e[31m>> all_subdomains <<\e[0m
\e[96m##################################################\e[0m
"
touch ./results/special_wordlist.txt
i=0
while [ $i -ne 7 ]
do
i=$(($i+1))
cat ./results/all_subdomains.txt | sed 's/www.//' | cut -d "." -f $i | sed -r '/^\s*$/d' >> ./results/specialx_wordlist.txt
done
cat ./results/specialx_wordlist.txt | sort -u | uniq > ./results/special_wordlist.txt
printf "
\e[96m##################################################\e[0m
\e[96mGet Livesubdomains...\e[0m \e[31m>> httprobe <<\e[0m
\e[96m##################################################\e[0m
"
cat ./results/all_subdomains.txt | /home/x0r3r0xf/go/bin/httpx -silent -mc 200,301,302 | /home/x0r3r0xf/go/bin/anew ./results/live_subdomains.txt
printf "
\e[96m##################################################\e[0m
\e[96mScreenshooting live subdomains...\e[0m \e[31m>> aquatone [Not working on VPS] <<\e[0m
\e[96m##################################################\e[0m
"
#cat ./results/live_subdomains.txt | /usr/bin/aquatone -scan-timeout 3000 -threads 5 -silent -screenshot-timeout 50000 -http-timeout 20000 -out subs-screenshots-folder