渗透测试中的域名收集：方法与自动化工具指南

# Installation
GO111MODULE=on go install GitHub.com/sw33tLie/bbscope@latest
# Usage
# Collect all range of Android APK from HackerOne
bbscope HackerOne -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -o t -c android 
# Collect all valid URLs in the scope from HackerOne
bbscope HackerOne -t <YOUR_TOKEN> -u <YOUR_HackerOne_USERNAME> -b -a -o t -c url | sort -u | anew HackerOne_url.txt
# Collect private projects）
bbscope HackerOne -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -b -p -o t -c all
# Collect Bugcrowd assets, same as HackerOne command
bbscope Bugcrowd -t <YOUR_TOKEN> -b -o t 
bbscope Bugcrowd -t <YOUR_TOKEN> -b -o t -c url
bbscope Bugcrowd -t <YOUR_TOKEN> -b -o t -c android
bbscope Bugcrowd -t <YOUR_TOKEN> -b -p -o t -c url
# Collect Intigriti assets
bbscope Intigriti -t <YOUR_TOKEN> -b -o t 
bbscope Intigriti -t <YOUR_TOKEN> -b -o t -c url
bbscope Intigriti -t <YOUR_TOKEN> -b -o t -c android
bbscope Intigriti -t <YOUR_TOKEN> -b -p -o t -c url
# Collect YesWeHack assets
bbscope YesWeHack -t <YOUR_TOKEN> -b -o t 
bbscope YesWeHack -t <YOUR_TOKEN> -b -o t -c url
bbscope YesWeHack -t <YOUR_TOKEN> -b -o t -c android
bbscope YesWeHack -t <YOUR_TOKEN> -b -p -o t -c url
# Collect Immunefi assets
bbscope Immunefi -b -o t 

Usage:
  bbscope h1 [flags]
  bbscope h1 [command]
Available Commands:
  Hacktivist  HackerOne Activity
Flags:
  -a, --active-only         Show only active programs
  -c, --categories string   Scope categories, comma separated (Available: all, url, cidr, mobile, android, apple, ai, other, hardware, code, executable) (default "all")
      --concurrency int     Concurrency of HTTP requests sent for fetching data (default 3)
  -h, --help                help for h1
      --public-only         Only print scope for public programs
  -t, --token string        HackerOne API token, get it here: https://hackerone.com/settings/api_token/edit
  -u, --username string     HackerOne username
Global Flags:
  -b, --bbpOnly            Only fetch programs offering monetary rewards (by default private programs are included)
      --config string      config file (default is $HOME/.bbscope.yaml)
  -d, --delimiter string   Delimiter character used when printing multiple data using the output flag (default " ")
  -l, --loglevel string    Set log level. Available: debug, info, warn, error, fatal (default "info")
      --oos                Also print out of scope items with [OOS] - Intigriti only for now
  -o, --output string      Output flags. Supported: t (target), d (target description), c (category), u (program URL). Can be combined. Example: -o tdu (default "t")
      --proxy string       HTTP Proxy (Useful for debugging. Example: http://127.0.0.1:8080)
  -p, --pvtOnly            Only fetch data from private programs

# Download and install
git clone https://github.com/kelvinBen/AppInfoScanner.git
cd AppInfoScanner
pip3 install -r requirements.txt
# Usage
# Scan the APK files and DEX files of Android applications, the download address of the APK files to be downloaded, and the directory where the files to be scanned are saved
python app.py android -i <Your APK File or DEX File or APK Download Url or Save File Dir>
# Scan the IPA files and Mach-o files of iOS applications, the download address of the IPA files to be downloaded, and the directory of files to be scanned
python app.py ios -i <Your IPA file or Mach-o File or IPA Download Url or Save File Dir>
# Scan the files, directories, and URLs of websites that need to be cached
python app.py web -i <Your Web file or Save Web Dir or Web Cache Url>

# install
git clone https://gitee.com/shmilylty/OneForAll.git
cd OneForAll && pip3 install -r requirements.txt -i https://mirrors.aliyun.com/pypi/simple/
# usage
python3 oneforall.py version
python3 oneforall.py check
python3 oneforall.py --target example.com run
python3 oneforall.py --targets ./domains.txt run
python3 oneforall.py --target example.com --alive False run
python3 oneforall.py --target example.com --brute False run
python3 oneforall.py --target example.com --port medium run
python3 oneforall.py --target example.com --fmt csv run
python3 oneforall.py --target example.com --dns False run
python3 oneforall.py --target example.com --req False run
python3 oneforall.py --target example.com --takeover False run
python3 oneforall.py --target example.com --show True run

# install
go install -v github.com/owasp-amass/amass/v4/...@master
# usage
amass enum -passive -d example.com

# install
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
# usage
# Single domain name
subfinder -d domain -all
# Bulk domain names
subfinder -dL domain.txt -all  
# -exclude-sources：This option enables you to exclude certain passive sources from domain enumeration
subfinder -exclude-sources:virustotal -d example.com
# -max-time: Set a new timeout when waiting for subdomain enumeration results (default is 10)
subfinder -max-time 1 -d example.com
# -o: Output is saved in an external file
subfinder -d example.com -o output.txt
# -oJ: Set the output to JSON format
subfinder -dL domain.txt -o output.json -oJ -nW
# -nW: This parameter is absolutely necessary if you use the JSON output we mentioned. It enables domain parsing and ensures efficient searching of this format.
# List all configurable sources
subfinder -ls  

# install
go install github.com/gwen001/github-subdomains@latest
#usage
github-subdomains -d example.com -t github_token

# install
go install -v github.com/boy-hack/ksubdomain/cmd/ksubdomain@latest
# usage
# Verification mode
# Read from file
./ksubdomain verify -f subdomain.txt
# Read from stdin
echo "www.example.com"|./ksubdomain verify --stdin
# Enumeration Mode
./ksubdomain enum -d baidu.com
# Get from stdin
echo "example.com"|./ksubdomain enum --stdin

# install
▶Run : git clone https://github.com/blechschmidt/massdns.git
▶Run : cd massdns
▶Run : make
▶Run : sudo make install
▶Run (Check/Usage) : massdns -h
# usage
# Parse the A record of the domain name and output it to the document
massdns -r lists/resolvers.txt -t A domains.txt > results.txt
massdns -r lists/resolvers.txt -t A -w results.txt domains.txt
massdns --resolvers ./resolvers.txt --output J --outfile ./out.json ./domains.txt

# install
go install -v github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest
# usage
# To batch verify subdomains, you need to be able to identify massdns. Windows configures massdns to the environment variable
shuffledns -l subdomains.txt -r resolvers.txt -mode resolve  
# Subdomain blasting, batch subdomain blasting is not supported
shuffledns -d hackerone.com -w wordlist.txt -r resolvers.txt -mode bruteforce 
# Subdomain blasting output to file
shuffledns -d domains.txt -w wordlist.txt -r resolver.txt -mode bruteforce  | anew sub.txt
# Specify massdns path and output to file
shuffledns -d hackerone.com -w wordlist.txt -m massdns_binary -o output.txt
# Linux uses brute force mode
shuffledns -d domain.txt -w wordlist.txt -r nameservers.txt -mode bruteforce | anew subs.txt | wc -l

# install
go install github.com/d3mondev/puredns/v2@latest
# usage
# PureDNS's resolve command is used to resolve domain names
puredns resolve domain.com
# Parse from file, save to file, and process pan-parse
puredns resolve domains.txt -r resolvers.txt -w valid_result.txt
或 cat domains.txt | puredns resolve
# Quiet mode parsing
puredns resolve domain.com -q 
或 cat domains.txt | puredns resolve -q
# Save the results to a file
puredns resolve -f domains.txt --write valid_domains.txt
# Specify the parser list
puredns resolve domain.com -r resolvers.txt
# Using Linux pipes
puredns resolve subs.txt -r nameservers.txt -w resolved.txt | wc -l

# install
go install github.com/projectdiscovery/alterx/cmd/alterx@latest
# usage
alertx -l www.example.com
alterx -list example.com -enrich -p '{{word}}-{{year}}.{{suffix}}' -pp word=keywords.txt -pp year=2023

# install
go install github.com/damit5/cdnCheck_go@latest
# usage
Usage of cdnCheck_go.exe:
  -as string
        All the mappings between domain names and IP addresses can be left blank if not saved
  -nd string
        There is no CDN domain name to save the address, just leave it blank if you don’t want to save it
  -ni string
        There is no CDN IP address to save, just leave it blank if you don’t want to save it
  -t string
        Documents to be scanned
  -thread int
        Concurrency (default 20)
.\cdnCheck_go.exe -t ..\all_subdomain_result.txt -nd nocdndomain.txt -ni nocdnip.txt -as domainip.txt

# install
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
# Common commands
# Get title, length, status code
httpx -title -content-length -status-code
# Request a single URL
httpx -u https://example.com
# Read a list of URLs from a file
httpx -l urls.txt
# Output the results to a file
httpx -u https://example.com -o output.txt
# Output the results in JSON format
httpx -u https://example.com -json output.json
# Status code filtering
httpx -u https://example.com -mc 200,302
# Skip SSL verification
httpx -u https://example.com -tls-skip-verify
# Display the status code, title, body length, and 301 redirect address
httpx -u https://example.com -l url.txt -sc -title -cl -location

# Install, download binary files and configure them into environment variables
https://github.com/EdgeSecurityTeam/EHole/releases
# Common commands
# Fingerprinting a single URL or IP address
ehole finger -u http://example.com
# Batch identify and specify output files to json
ehole finger -l urls.txt -o output.json
# Batch identify and specify output files to xlsx
ehole finger -l urls.txt -o output.xlsx
# Output detailed information
ehole finger -l urls.txt -v