diff --git a/modules/web/subdomain_btf.py b/modules/web/subdomain_btf.py new file mode 100644 index 0000000..fc28c09 --- /dev/null +++ b/modules/web/subdomain_btf.py @@ -0,0 +1,82 @@ +# This module requires katana framework +# https://github.com/PowerScript/KatanaFramework + +# :-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-: # +# Katana Core import # +from core.KatanaFramework import * # +# :-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-: # + +# LIBRARIES +from bs4 import BeautifulSoup +import httplib,re +# END LIBRARIES + +# INFORMATION MODULE +def init(): + init.Author ="RedToor" + init.Version ="1.0" + init.Description ="Subdomain Brute Force" + init.CodeName ="web/sub.dns" + init.DateCreation ="25/04/2017" + init.LastModification ="25/04/2017" + init.References =None + init.License =KTF_LINCENSE + init.var ={} + + # DEFAULT OPTIONS MODULE + init.options = { + # NAME VALUE RQ DESCRIPTION + 'target':[LOCAL_IP ,True , 'Host Target'], + 'port' :[HTTP_PORT ,False, 'Port Target'], + 'file' :[TABLE_SUBDOMAIN ,False, 'Subdomain List'] + } + return init +# END INFORMATION MODULE + +# CODE MODULE ############################################################################################ +def main(run): + NET.CheckConnectionHost(init.var['target'],init.var['port'],5) + Loadingfile(init.var['file']) + Totalresults="" + + printk.step("[1] Step : Starting Brute Force...") + with open(init.var['file'],'r') as list_path: + for path in list_path: + path=path.replace("\n","") + if init.var['port'] == "443" : + connection = httplib.HTTPSConnection(path+"."+init.var['target']) + else : connection = httplib.HTTPConnection(path+"."+init.var['target'],int(init.var['port'])) + connection.addheaders=[('User-agent', WEB.RamdonAgent())] + connection.request("GET","/") + response = connection.getresponse() + + if response.status == 200 or response.status == 301: + printk.suff(" | Response "+path+"."+init.var['target']) + Totalresults+="\t |"+path+"."+init.var['target']+"\n" + else:printk.inf(" | Checking `"+colors[0]+path+"` Response:"+str(response.status)) + connection.close() + printk.step("[2] Step : Starting Google Dorking...") + connection = httplib.HTTPSConnection("www.google.com") + connection.request("GET", "/search?q=inurl:."+str(init.var['target'])) + connection.addheaders=[('User-agent', WEB.RamdonAgent())] + response = connection.getresponse() + + if response.status == 302: + html_response = response.read() + urls = re.findall('http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+', html_response) + host_name = re.findall('(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}',urls[0]) + connection = httplib.HTTPSConnection(host_name[0]) + connection.request("GET", "/search?q=inurl:admin+site:"+str(init.var['target'])) + connection.addheaders=[('User-agent', WEB.RamdonAgent())] + response = connection.getresponse() + + if response.status == 200: + soup = BeautifulSoup(response.read(), "lxml") + divList = soup.findAll('cite') + for ids in divList: + printk.suff(" | Result "+ids.text) + Totalresults+="\t | "+ids.text+"\n" + + UTIL.sRegister(init,Totalresults) + +# END CODE MODULE ############################################################################################