diff options
37 files changed, 0 insertions, 1396 deletions
diff --git a/Makefile b/Makefile deleted file mode 100644 index 2241dba..0000000 --- a/Makefile +++ /dev/null @@ -1,23 +0,0 @@ -submodules = gxfr dnsrecon bxfr whatweb -security_modules = subdomains revip whatweb - -all: init all-mods - -init: init-submodules $(submodules) -init-submodules: - cd ..;git submodule init; git submodule update -$(submodules): - cd repos/$@ ; git checkout master;git pull - -all-mods: $(addprefix public_commands/,$(security_modules)) -public_commands/%:commands/% - ln -s ../$< $@ - -debian-autostart: - useradd reaktor ||: - cp startup/init.d/reaktor-debian /etc/init.d/reaktor - cp startup/conf.d/reaktor /etc/default/ - update-rc.d reaktor defaults -supervisor-autostart: - useradd reaktor ||: - cp startup/supervisor/Reaktor.conf /etc/supervisor/conf.d/ diff --git a/UDP/README b/UDP/README deleted file mode 100644 index 587c804..0000000 --- a/UDP/README +++ /dev/null @@ -1,52 +0,0 @@ -# Specifications -From 2011-09-16: -## Use Case - [ - { - "port": 1337, - "pattern": "XXYY", - "comment" : "does the right thing", - "action" : { - "POST": { - "url" : "xyz", - "data" : "abc" - } - } - } - ] -## Head definition - { - "bind_addr" : "127.0.0.1", - "port" : 1234, - "pattern" : "XXZZ", - "action" : { }, - } -bind is an optional entry which lets the user define a bind address for the server. -terminator is optional which lets the user define the EOM terminator. - -## Actions -### POST -"POST" : { - "url" : "http://euer.krebsco.de/", - "data" : "{ \"something\" : \"else\" }" - } - -### PROCESS -Process is taken from //hyper/process/test/bc.json - rev:a7fd3f - -stdout/stderr are optional and if left away data will be written to real stdout/stderr -in the process in envp => "payload" will be allocated for the given payload from the network - - "PROCESS" : { - { - "path": "/usr/bin/bc", - "argv": [ - "bc" - ], - "envp": { - "was": "geht", - }, - "stdout": "uri:///path/to/somewhere", - "stderr": "uri:///path/to/somewhere" - } - } diff --git a/UDP/config b/UDP/config deleted file mode 100644 index 623c721..0000000 --- a/UDP/config +++ /dev/null @@ -1,15 +0,0 @@ -[ - { - "comment" : "listener for licht.shack", - "bind_addr" : "0.0.0.0", - "port" : 2342, - "pattern" : "", - "action" : { - "PROCESS" : { - "path" : "/krebs/Reaktor/udp_commands/licht_resolver", - "argv" : [ ], - "envp" : { } - } - } - } -] diff --git a/UDP/index b/UDP/index deleted file mode 100755 index ffe3d6b..0000000 --- a/UDP/index +++ /dev/null @@ -1,94 +0,0 @@ -#!/usr/bin/python - -import asyncore, socket -import logging,subprocess -import re -import json -log = logging.getLogger('ubot') - -def enable_syslog(logger): - import logging.handlers as handlers - from logging import Formatter - hdlr = handlers.SysLogHandler( - facility=handlers.SysLogHandler.LOG_DAEMON) - formatter = Formatter( - '%(filename)s: %(levelname)s: %(message)s') - hdlr.setFormatter(formatter) - logger.addHandler(hdlr) - -from twisted.internet.protocol import DatagramProtocol -from twisted.internet import reactor -from twisted.application.internet import MulticastServer -from socket import SOL_SOCKET,SO_BROADCAST -class ubot(DatagramProtocol): -# def startProtocol(self): -# log.info("Starting Listener for Multicast") -# self.transport.joinGroup("255.255.255.255") - - """ UDP Bot """ - def startProtocol(self): - log.info("starting Protocol at host (%s)" % self.bind_addr) - #self.transport. - if self.bind_addr != "255.255.255.255": - self.transport.joinGroup(self.bind_addr) - else: - self.transport.socket.setsockopt(SOL_SOCKET,SO_BROADCAST,True) - def __init__(self, pattern,action,bind_addr,**kwargs): - #DatagramProtocol.__init__(self) - self.data = '' - self.pattern = pattern - self.action = action - self.bind_addr = bind_addr - - def datagramReceived(self,datagram,addr): - self.data = datagram - log.debug('<< %s' % self.data) - if self.find_pattern(): - self.start_action() - - def find_pattern(self): - """ returns true if own pattern is found""" - log.debug("Pattern is %s" %self.pattern) - ret = re.search(self.pattern,self.data) - if ret: - log.info("Match \"%s\" with pattern \"%s\"" % ((ret.string.strip()),self.pattern)) - else: - log.info("No Match") - return ret - - - def start_action(self): - """ runs all the defined actions""" - log.debug("Actions: %s" % str(self.action)) - self.start_process() - self.start_post() - - def start_process(self): - try: - act = self.action["PROCESS"] - proc = [] - proc.append(act["path"]) - proc.extend(act["argv"]) - - env = act["envp"] - env["payload"] = json.dumps(self.data) - log.info("Starting Process: %s (env: %s)" % (proc,env)) - subprocess.Popen(proc,env=env) - except Exception as e: - log.error(e) - def start_post(self): - pass - -def load_conf(conf_file): - return json.load(open(conf_file)) - - -if __name__ == "__main__": - import os - #enable_syslog(log) - HERE = os.path.dirname(os.path.realpath(__file__)) - lol = logging.DEBUG if os.environ.get('debug',False) else logging.INFO - logging.basicConfig(level=lol) - for i in load_conf("%s/config" %HERE): - reactor.listenMulticast(i["port"], ubot(**i)) - reactor.run() diff --git a/auth.lst b/auth.lst deleted file mode 100755 index 8b13789..0000000 --- a/auth.lst +++ /dev/null @@ -1 +0,0 @@ - diff --git a/elchos/admin.lst b/elchos/admin.lst deleted file mode 100644 index e69de29..0000000 --- a/elchos/admin.lst +++ /dev/null diff --git a/elchos/auth.lst b/elchos/auth.lst deleted file mode 100644 index e69de29..0000000 --- a/elchos/auth.lst +++ /dev/null diff --git a/elchos/commands/ftpget b/elchos/commands/ftpget deleted file mode 100755 index 74e76f8..0000000 --- a/elchos/commands/ftpget +++ /dev/null @@ -1,58 +0,0 @@ -#!/bin/sh -# usage: $0 [-d] uri sharename[/subdirs] -exec 2>&1 -set -euf -ncdc_user=hooker -usage(){ - cat <<EOF -usage: $0 [-d] uri share[/subdirs] - -d -- uri is a directory to be mirrored - share -- vag[0-n] - -EOF -} -examples(){ - cat <<EOF -examples: ftpget -d http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/0.8 vag0/firefox_releases - -> 0.8 directory is stored to /media/vag0/firefox_releases - - ftpget -d http://speedtest.qsc.de/10MB.qsc vag0/ - -> 10MB.qsc is stored to /media/vag0/10MB.qsc -EOF -} -if test "${1:--h}" == '-h' -o "${1:-}" == '--help';then - usage - examples - exit 0 -fi -if test ${1:-} == '-d' ;then - is_dir=true - shift -fi - -target="${1:-}" -if !( echo "$target" | egrep -q '^(ftps*://|https*://)' );then - exit 23 -fi - -share=$( printf "%s" "${2?provide share name}" |head -1 | sed 's#\.\./##') -sharepath=/media/${share%%/*} -realshare="/media/$share" -test ! -e "$sharepath" && echo "$sharepath does not exist!" && exit 23 - -sudo -u $ncdc_user /usr/bin/mkdir -p "$realshare" - -if test -z ${is_dir:-};then - cmd="lftpget \"$target\"" -else - cmd="lftp -e \"mirror;exit\" $target" -fi - - if ! sudo -u $ncdc_user /usr/bin/tmux has-session -t dl >/dev/null 2>&1 ;then - sudo -u $ncdc_user /usr/bin/tmux new-session -s dl -d -c "$realshare" "$cmd" - else - sudo -u $ncdc_user /usr/bin/tmux new-window -t dl -c "$realshare" "$cmd" - fi -#sudo -u $ncdc_user /usr/bin/tmux new-window -t dl -#cd "$realshare" ;sudo -u hooker /usr/bin/lftpget "$target" -echo "download started, check with 'list_downloads'" diff --git a/elchos/commands/identify b/elchos/commands/identify deleted file mode 100755 index c2fb2c5..0000000 --- a/elchos/commands/identify +++ /dev/null @@ -1,22 +0,0 @@ -#!/usr/bin/env python -import imp -import os,sys - -def load_config(filename): - dirname = os.path.dirname(filename) - modname, ext = os.path.splitext(os.path.basename(filename)) - file, pathname, description = imp.find_module(modname, [ dirname ]) - return imp.load_module(modname, file, pathname, description) - -config = load_config(os.environ['config_filename']) - -with open(config.admin_file) as f: - for line in f: - nick,secret = line.split() - if sys.argv[1] == secret: - print("identified you as %s!"%nick) - with open(config.auth_file,'a+') as g: - g.write(os.environ['_prefix'] +"\n") - sys.exit(0) - -print("unable to identify you, sorry") diff --git a/elchos/commands/io b/elchos/commands/io deleted file mode 100755 index eb04ae9..0000000 --- a/elchos/commands/io +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/zsh -printf '%-10s %-7s %-7s %-7s %-7s\n' IFACE rxkB/s txkB/s rxTotal txTotal -sar -n DEV 1 3 | grep Average: | grep -v IFACE | grep -v ' lo ' | while read line;do - dev=$(echo $line | awk '{print $2}') - rxkb=$(echo $line | awk '{print $5}') - txkb=$(echo $line | awk '{print $6}') - total_bytes_r=$(cat /proc/net/dev | grep ${dev}: | awk '{print $2}') - total_bytes_t=$(cat /proc/net/dev | grep ${dev}: | awk '{print $10}') - - printf '%-10s %-7s %-7s %-7s %-7s\n' $dev $rxkb $txkb $((total_bytes_r / (1024*1024))) $((total_bytes_t / (1024*1024))) -done -printf "%-10s %-7s %-7s\n" "DSK" "rxkB/s" "txkB/s" -sar -p -d 1 3 | grep Average: | grep -v ' DEV ' |while read line; -do - dsk=$(echo $line | awk '{print $2}') - rd_sec=$(echo $line | awk '{print $4}') - wr_sec=$(echo $line | awk '{print $5}') - if echo $dsk | egrep -q '(sd|hd|vd)';then - # TODO for some reason 0.00 can only be interpreted correctly as arithmetic - # expession by zsh - # - # rd is counted in blocks (which is 512 bytes) - printf "%-10s %-7.2f %-7.2f\n" "/dev/$dsk" "$((rd_sec*2))" "$((wr_sec*2))" - fi -done diff --git a/elchos/commands/ips b/elchos/commands/ips deleted file mode 100755 index 17c3965..0000000 --- a/elchos/commands/ips +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/sh -ip addr | grep 'inet ' | awk '{print $2}' | grep -v 127.0.0.1 | grep . diff --git a/elchos/commands/list_downloads b/elchos/commands/list_downloads deleted file mode 100755 index f53067d..0000000 --- a/elchos/commands/list_downloads +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/sh -ncdc_user=hooker -count=$(sudo -u $ncdc_user /usr/bin/tmux list-windows -t dl 2>/dev/null| wc -l) - -test $count -eq 0 && echo "no downloads running" && exit 0 -for i in $(seq 0 $(($count-1)));do - sudo -u $ncdc_user /usr/bin/tmux capture-pane -t dl:$i -p | grep -v '^$' | tail -n 1 -done diff --git a/elchos/commands/onion b/elchos/commands/onion deleted file mode 100755 index 1a20299..0000000 --- a/elchos/commands/onion +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/sh - -sudo -u tor /krebs/bin/tor-get-hidden-service.sh || echo "no hidden service configured" diff --git a/elchos/commands/reboot b/elchos/commands/reboot deleted file mode 100755 index a264831..0000000 --- a/elchos/commands/reboot +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/sh -echo "system is going down" -sudo /usr/bin/reboot diff --git a/elchos/commands/refresh_shares b/elchos/commands/refresh_shares deleted file mode 100755 index 1005998..0000000 --- a/elchos/commands/refresh_shares +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -ncdc_user=hooker -sudo /krebs/bin/refresh-shares.ship 2>&1 -sudo -u $ncdc_user /krebs/bin/update-search.sh 2>&1 diff --git a/elchos/commands/shares b/elchos/commands/shares deleted file mode 100755 index 1601d58..0000000 --- a/elchos/commands/shares +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/sh -df -h | grep '/media/' diff --git a/elchos/commands/update_search b/elchos/commands/update_search deleted file mode 100755 index 1db1c1b..0000000 --- a/elchos/commands/update_search +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/sh -ncdc_user=hooker -sudo -u $ncdc_user /krebs/bin/update-search.sh diff --git a/elchos/config.py b/elchos/config.py deleted file mode 100644 index eeeacd8..0000000 --- a/elchos/config.py +++ /dev/null @@ -1,78 +0,0 @@ -import socket -name = socket.gethostname() -cfg_file = "/krebs/config.sh" - -# TODO: shell config file cannot contain variables or anything fancy -ret ={} - -import shlex -## load config file, lex split every line, split at = -with open(cfg_file) as f: - for line in f: - k,v = shlex.split(line)[0].split("=",1) - ret[k] = v - -#irc_server = 'irc.freenode.net' -irc_server = ret["IRC_SERVER"] - -debug = False - -state_dir='/krebs/painload/Reaktor' -irc_alarm_timeout = 300 -irc_hammer_interval = 10 -irc_kill_timeout = 360 -irc_nickname = name -irc_restart_timeout = 5 -irc_port = 6667 -irc_channels = [ - '#elchOS' -] - -admin_file='admin.lst' -auth_file='auth.lst' - -def default_command(cmd): - return { - 'capname': cmd, - 'pattern': '^(?:' + name + '|\\*):\\s*' + cmd + '\\s*(?:\\s+(?P<args>.*))?$', - 'argv': [ 'commands/' + cmd ] } - -def elch_command(cmd): - return { - 'capname': cmd, - 'pattern': '^(?:' + name + '|\\*):\\s*' + cmd + '\\s*(?:\\s+(?P<args>.*))?$', - 'argv': [ 'elchos/commands/' + cmd ] } - -public_commands = [ - default_command('caps'), - default_command('hello'), - default_command('uptime'), - default_command('badcommand'), - default_command('rev'), - elch_command('search'), - elch_command('list_downloads'), - elch_command('io'), - elch_command('ips'), - elch_command('shares'), - elch_command('onion'), - default_command('nocommand'), - # command not found - { 'pattern': '^(?:' + name + '|\\*):.*', - 'argv': [ 'commands/respond','You are made of stupid!'] }, - # "highlight" - { 'pattern': '.*\\b' + name + '\\b.*', - 'argv': [ 'commands/say', 'I\'m famous' ] }, - # identify via direct connect - { 'capname': 'identify', - 'pattern': 'identify' + '\\s*(?:\\s+(?P<args>.*))?$', - 'argv' : [ 'commands/identify' ]} - -] - -commands = [ - default_command('reload'), - elch_command('update_search'), - elch_command('refresh_shares'), - elch_command('ftpget'), - elch_command('reboot') -] diff --git a/etc/conf.d/reaktor b/etc/conf.d/reaktor deleted file mode 100644 index a4f3f8e..0000000 --- a/etc/conf.d/reaktor +++ /dev/null @@ -1,2 +0,0 @@ -export target="#krebsco" -export host="irc.freenode.com" diff --git a/etc/init.d/reaktor-debian b/etc/init.d/reaktor-debian deleted file mode 100755 index a94384f..0000000 --- a/etc/init.d/reaktor-debian +++ /dev/null @@ -1,102 +0,0 @@ -#!/bin/sh -# uses template from /etc/init.d/skeleton -### BEGIN INIT INFO -# Provides: reaktor -# Required-Start: -# Required-Stop: -# Default-Start: 2 3 4 5 -# Default-Stop: 0 1 6 -# Short-Description: reaktor -# Description: starts reaktor daemon -# -### END INIT INFO - -PATH=/sbin:/usr/sbin:/bin:/usr/bin -NAME=reaktor -USER=reaktor -DESC="$NAME daemon" -DAEMON=/usr/bin/python -DAEMON_DIR="/krebs/Reaktor/IRC/" -DAEMON_ARGS="${DAEMON_DIR}/asybot.py" -PIDFILE=/var/run/$NAME.pid -SCRIPTNAME=/etc/init.d/$NAME - -[ -x "$DAEMON" ] || exit 0 -[ -r /etc/default/$NAME ] && . /etc/default/$NAME -. /lib/init/vars.sh -. /lib/lsb/init-functions - -do_start() -{ - # 0 if daemon has been started - # 1 if daemon was already running - # 2 if daemon could not be started - start-stop-daemon -b -d $DAEMON_DIR/.. -c $USER --start --quiet --make-pidfile --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \ - || return 1 - start-stop-daemon -b -d $DAEMON_DIR/.. -c $USER --start --quiet --make-pidfile --pidfile $PIDFILE --exec $DAEMON -- \ - $DAEMON_ARGS \ - || return 2 -} - -do_stop() -{ - # 0 if daemon has been stopped - # 1 if daemon was already stopped - # 2 if daemon could not be stopped - start-stop-daemon --stop --retry=TERM/30/KILL/5 --pidfile $PIDFILE - RETVAL="$?" - [ "$RETVAL" = 2 ] && return 2 - rm -f $PIDFILE - return "$RETVAL" -} - -do_reload() { - start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE - return 0 -} - -case "$1" in - start) - [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" - do_start - case "$?" in - 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; - 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; - esac - ;; - stop) - [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" - do_stop - case "$?" in - 0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;; - 2) [ "$VERBOSE" != no ] && log_end_msg 1 ;; - esac - ;; - status) - status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $? - ;; - restart|force-reload) - log_daemon_msg "Restarting $DESC" "$NAME" - do_stop - case "$?" in - 0|1) - do_start - case "$?" in - 0) log_end_msg 0 ;; - 1) log_end_msg 1 ;; - *) log_end_msg 1 ;; - esac - ;; - *) - # Failed to stop - log_end_msg 1 - ;; - esac - ;; - *) - echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2 - exit 3 - ;; -esac - -: diff --git a/etc/supervisor/Reaktor.conf b/etc/supervisor/Reaktor.conf deleted file mode 100644 index 497066e..0000000 --- a/etc/supervisor/Reaktor.conf +++ /dev/null @@ -1,6 +0,0 @@ -[program:Reaktor] -command=/usr/bin/python2.6 IRC/asybot.py -environment=host='irc.freenode.net',target='#krebsco' -redirect_stderr=true -user=reaktor -directory=/krebs/Reaktor diff --git a/etc/systemd/system/Reaktor.service b/etc/systemd/system/Reaktor.service deleted file mode 100644 index 6bb3e55..0000000 --- a/etc/systemd/system/Reaktor.service +++ /dev/null @@ -1,14 +0,0 @@ -[Unit] -Description=Reaktor for user %i -After=network.target nss-lookup.target - -[Service] -Type=normal -#TODO - make reaktor path variable -User=reaktor -ExecStart=/krebs/painload/Reaktor/index -Restart=always -RestartSec=3 - -[Install] -WantedBy=multi-user.target diff --git a/repos/bxfr/bxfr.py b/repos/bxfr/bxfr.py deleted file mode 100644 index 8e6bd10..0000000 --- a/repos/bxfr/bxfr.py +++ /dev/null @@ -1,238 +0,0 @@ -#!/usr/bin/python -tt - -# gxfr replicates dns zone transfers by enumerating subdomains using advanced search engine queries and conducting dns lookups. -# By Tim Tomes (LaNMaSteR53) -# Available for download at http://LaNMaSteR53.com or http://code.google.com/p/gxfr/ - -import sys, os.path, urllib, urllib2, re, time, socket, random, socket - - -def help(): - print """ Syntax: ./gxfr.py domain [options] - - -h, --help this screen - -v enable verbose mode - -t [num of seconds] set number of seconds to wait between queries (default=15) - -q [max num of queries] restrict to maximum number of queries (default=0, indefinite) - --dns-lookup enable dns lookups of all subdomains - --proxy [file|ip:port|-] use a proxy or list of open proxies to send queries (@random w/list) - - [file] must consist of 1 or more ip:port pairs - - replace filename with '-' (dash) to accept stdin - --user-agent ['string'] set custom user-agent string - --timeout [seconds] set socket timeout (default=system default) - --csv [file] - - Examples: - $ ./gxfr.py foxnews.com --dns-lookup -v - $ ./gxfr.py foxnews.com --dns-lookup --proxy open_proxies.txt --timeout 10 - $ ./gxfr.py foxnews.com --dns-lookup -t 5 -q 5 -v --proxy 127.0.0.1:8080 - $ curl http://rmccurdy.com/scripts/proxy/good.txt | ./gxfr.py website.com -v -t 3 --proxy - - """ - sys.exit(2) - -if len(sys.argv) < 2: - help() - -if '-h' in sys.argv or '--help' in sys.argv: - help() - -# declare vars and process arguments -#http://www.bing.com/search?q=site%3agoogle.de&qs=n&filt=all&pq=site%3agoogle.d&sc=8-5&sp=-1&sk=&first=1&FORM=PORE -query_cnt = 0 -csvname = False -domain = sys.argv[1] -sys.argv = sys.argv[2:] -lookup = False -encrypt = True -base_url = 'http://www.bing.com' -base_uri = '/search?qs=n&form=QBRE&sc=0-0&sp=-1&sk=' -base_query = 'site:' + domain -pattern = '//([\.\w-]*)\.%s.+?' % (domain) -proxy = False -user_agent = 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; FDM; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 1.1.4322)' -verbose = False -secs = 15 -max_queries = 10 # default = 10 queries -# process command line arguments -if len(sys.argv) > 0: - if '--dns-lookup' in sys.argv: - lookup = True - if '--csv' in sys.argv: - csvname = sys.argv[sys.argv.index('--csv') + 1] - if '--proxy' in sys.argv: - proxy = True - filename = sys.argv[sys.argv.index('--proxy') + 1] - if filename == '-': - proxies = sys.stdin.read().split() - elif os.path.exists(filename): - content = open(filename).read() - proxies = re.findall('\d+\.\d+\.\d+\.\d+:\d+', content) - elif re.match(r'^\d+\.\d+\.\d+\.\d+:\d+$', filename): - proxies = [filename] - else: - help() - if '--timeout' in sys.argv: - timeout = int(sys.argv[sys.argv.index('--timeout') + 1]) - socket.setdefaulttimeout(timeout) - if '--user-agent' in sys.argv: - user_agent = sys.argv[sys.argv.index('--user-agent') + 1] - if '-v' in sys.argv: - verbose = True - if '-t' in sys.argv: - secs = int(sys.argv[sys.argv.index('-t') + 1]) - if '-q' in sys.argv: - max_queries = int(sys.argv[sys.argv.index('-q') + 1]) -subs = [] -new = True -page = 0 - -# --begin-- -print '[-] domain:', domain -print '[-] user-agent:', user_agent -# execute search engine queries and scrape results storing subdomains in a list -print '[-] querying search engine, please wait...' -# loop until no new subdomains are found -while new == True: - try: - query = '' - # build query based on results of previous results - for sub in subs: - query += ' -site:%s.%s' % (sub, domain) - full_query = base_query + query - start_param = '&first=%s' % (str(page*10)) - query_param = '&q=%s&pq=%s' % (urllib.quote_plus(full_query),urllib.quote_plus(full_query)) - if len(base_uri) + len(query_param) + len(start_param) < 2048: - last_query_param = query_param - params = query_param + start_param - else: - params = last_query_param[:2047-len(start_param)-len(base_uri)] + start_param - full_url = base_url + base_uri + params - # note: query character limit is passive in mobile, but seems to be ~794 - # note: query character limit seems to be 852 for desktop queries - # note: typical URI max length is 2048 (starts after top level domain) - if verbose: print '[+] using query: %s...' % (full_url) - # build web request and submit query - request = urllib2.Request(full_url) - # spoof user-agent string - request.add_header('User-Agent', user_agent) - # if proxy is enabled, use the correct handler - if proxy == True: - # validate proxies at runtime - while True: - try: - # select a proxy from list at random - num = random.randint(0,len(proxies)-1) - host = proxies[num] - opener = urllib2.build_opener(urllib2.ProxyHandler({'http': host})) - if verbose: print '[+] sending query to', host - # send query to proxy server - result = opener.open(request).read() - # exit while loop if successful - break - except Exception as inst: - print '[!] %s failed: %s' % (host, inst) - if len(proxies) == 1: - # exit of no proxy servers from list are valid - print '[-] valid proxy server not found' - sys.exit(2) - else: - # remove host from list of proxies and try again - del proxies[num] - else: - opener = urllib2.build_opener(urllib2.HTTPHandler(), urllib2.HTTPSHandler()) - # send query to search engine - try: - result = opener.open(request).read() - except Exception as inst: - print '[!] {0}'.format(inst) - if str(inst).index('503') != -1: print '[!] possible shun: use --proxy or find something else to do for 24 hours :)' - sys.exit(2) - if not verbose: sys.stdout.write('.'); sys.stdout.flush() - #if not verbose: sys.stdout.write('\n'); sys.stdout.flush() - # iterate query count - query_cnt += 1 - sites = re.findall(pattern, result) - # create a uniq list - sites = list(set(sites)) - new = False - # add subdomain to list if not already exists - for site in sites: - if site not in subs: - if verbose: print '[!] subdomain found:', site - subs.append(site) - new = True - # exit if maximum number of queries has been made - if query_cnt == max_queries: - print '[-] maximum number of queries made...' - break - # start going through all pages if querysize is maxed out - if new == False: - # exit if all subdomains have been found - if not 'Next page' in result: - #import pdb; pdb.set_trace() # curl to stdin breaks pdb - print '[-] all available subdomains found...' - break - else: - page += 1 - new = True - if verbose: print '[+] no new subdomains found on page. jumping to result %d.' % (page*10) - # sleep script to avoid lock-out - if verbose: print '[+] sleeping to avoid lock-out...' - time.sleep(secs) - except KeyboardInterrupt: - # catch keyboard interrupt and gracefull complete script - break - -# print list of subdomains -print '[-] successful queries made:', str(query_cnt) -if verbose: - # rebuild and display final query if in verbose mode - #final_query = '' - #for sub in subs: - # final_query += '+-site:%s.%s' % (sub, domain) - #print '[+] final query string: %sstart=%s&%s%s' % (base_url, str(page*10), base_query, query) - print '[+] final query string: %s' % (full_url) -print ' ' -print '[subdomains] -', str(len(subs)) -csvwriter = False -try: - if csvname: - import csv - csvwriter = csv.writer(open(csvname,'wb')) -except: - print "[!] Cannot open CSV" -for sub in subs: - dom = '%s.%s' % (sub, domain ) - - #host resolution makes this computer more visible - hostname,aliases,ips = socket.gethostbyname_ex(dom) - #print hostname,aliases,ip - print dom,",".join(ips) - try: - line = [dom] + ips - csvwr |