Skip to content

Commit 3571387

Browse files
x4nth055x4nth055
authored
first upload
1 parent 935def0 commit 3571387

58 files changed

Lines changed: 3016 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎chapter-1/domain-names/domain_info_extractor.py‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
import requests
2+
import whois
3+
4+
import argparse
5+
6+
7+
def is_registered(domain_name):
8+
"""
9+
A function that returns a boolean indicating
10+
whether a `domain_name` is registered
11+
"""
12+
try:
13+
w = whois.whois(domain_name)
14+
except Exception:
15+
return False
16+
else:
17+
return bool(w.domain_name)
18+
19+
20+
def get_discovered_subdomains(domain, subdomain_list, timeout=2):
21+
# a list of discovered subdomains
22+
discovered_subdomains = []
23+
for subdomain in subdomain_list:
24+
# construct the url
25+
url = f"http://{subdomain}.{domain}"
26+
try:
27+
# if this raises a connection error, that means the subdomain does not exist
28+
requests.get(url, timeout=timeout)
29+
except requests.ConnectionError:
30+
# if the subdomain does not exist, just pass, print nothing
31+
pass
32+
else:
33+
print("[+] Discovered subdomain:", url)
34+
# append the discovered subdomain to our list
35+
discovered_subdomains.append(url)
36+
37+
return discovered_subdomains
38+
39+
40+
if __name__ == "__main__":
41+
parser = argparse.ArgumentParser(description="Domain name information extractor, uses WHOIS db and scans for subdomains")
42+
parser.add_argument("domain", help="The domain name without http(s)")
43+
parser.add_argument("-t", "--timeout", type=int, default=2,
44+
help="The timeout in seconds for prompting the connection, default is 2")
45+
parser.add_argument("-s", "--subdomains", default="subdomains.txt",
46+
help="The file path that contains the list of subdomains to scan, default is subdomains.txt")
47+
parser.add_argument("-o", "--output",
48+
help="The output file path resulting the discovered subdomains, default is {domain}-subdomains.txt")
49+
50+
# parse the command-line arguments
51+
args = parser.parse_args()
52+
if is_registered(args.domain):
53+
whois_info = whois.whois(args.domain)
54+
# print the registrar
55+
print("Domain registrar:", whois_info.registrar)
56+
# print the WHOIS server
57+
print("WHOIS server:", whois_info.whois_server)
58+
# get the creation time
59+
print("Domain creation date:", whois_info.creation_date)
60+
# get expiration date
61+
print("Expiration date:", whois_info.expiration_date)
62+
# print all other info
63+
print(whois_info)
64+
65+
print("="*50, "Scanning subdomains", "="*50)
66+
# read all subdomains
67+
with open(args.subdomains) as file:
68+
# read all content
69+
content = file.read()
70+
# split by new lines
71+
subdomains = content.splitlines()
72+
discovered_subdomains = get_discovered_subdomains(args.domain, subdomains)
73+
# make the discovered subdomains filename dependant on the domain
74+
discovered_subdomains_file = f"{args.domain}-subdomains.txt"
75+
# save the discovered subdomains into a file
76+
with open(discovered_subdomains_file, "w") as f:
77+
for subdomain in discovered_subdomains:
78+
print(subdomain, file=f)

‎chapter-1/domain-names/domain_validator.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import whois # pip install python-whois
2+
3+
def is_registered(domain_name):
4+
"""
5+
A function that returns a boolean indicating
6+
whether a `domain_name` is registered
7+
"""
8+
try:
9+
w = whois.whois(domain_name)
10+
except Exception:
11+
return False
12+
else:
13+
return bool(w.domain_name)
14+
15+
16+
if __name__ == "__main__":
17+
print(is_registered("google.com"))
18+
print(is_registered("something-that-do-not-exist.com"))

‎chapter-1/domain-names/domain_whois.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
import whois
2+
from domain_validator import is_registered
3+
4+
domain_name = "google.com"
5+
if is_registered(domain_name):
6+
whois_info = whois.whois(domain_name)
7+
# print the registrar
8+
print("Domain registrar:", whois_info.registrar)
9+
# print the WHOIS server
10+
print("WHOIS server:", whois_info.whois_server)
11+
# get the creation time
12+
print("Domain creation date:", whois_info.creation_date)
13+
# get expiration date
14+
print("Expiration date:", whois_info.expiration_date)
15+
# print all other info
16+
print(whois_info)

‎chapter-1/domain-names/fast_subdomain_scanner.py‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
import requests
2+
from threading import Thread, Lock
3+
from queue import Queue
4+
5+
q = Queue()
6+
list_lock = Lock()
7+
discovered_domains = []
8+
9+
def scan_subdomains(domain):
10+
global q
11+
while True:
12+
# get the subdomain from the queue
13+
subdomain = q.get()
14+
# scan the subdomain
15+
url = f"http://{subdomain}.{domain}"
16+
try:
17+
requests.get(url)
18+
except requests.ConnectionError:
19+
pass
20+
else:
21+
print("[+] Discovered subdomain:", url)
22+
# add the subdomain to the global list
23+
with list_lock:
24+
discovered_domains.append(url)
25+
26+
# we're done with scanning that subdomain
27+
q.task_done()
28+
29+
30+
def main(domain, n_threads, subdomains):
31+
global q
32+
33+
# fill the queue with all the subdomains
34+
for subdomain in subdomains:
35+
q.put(subdomain)
36+
37+
for t in range(n_threads):
38+
# start all threads
39+
worker = Thread(target=scan_subdomains, args=(domain,))
40+
# daemon thread means a thread that will end when the main thread ends
41+
worker.daemon = True
42+
worker.start()
43+
44+
45+
if __name__ == "__main__":
46+
import argparse
47+
parser = argparse.ArgumentParser(description="Faster Subdomain Scanner using Threads")
48+
parser.add_argument("domain", help="Domain to scan for subdomains without protocol (e.g without 'http://' or 'https://')")
49+
parser.add_argument("-l", "--wordlist", help="File that contains all subdomains to scan, line by line. Default is subdomains.txt",
50+
default="subdomains.txt")
51+
parser.add_argument("-t", "--num-threads", help="Number of threads to use to scan the domain. Default is 10", default=10, type=int)
52+
parser.add_argument("-o", "--output-file", help="Specify the output text file to write discovered subdomains", default="discovered-subdomains.txt")
53+
54+
args = parser.parse_args()
55+
domain = args.domain
56+
wordlist = args.wordlist
57+
num_threads = args.num_threads
58+
output_file = args.output_file
59+
60+
main(domain=domain, n_threads=num_threads, subdomains=open(wordlist).read().splitlines())
61+
q.join()
62+
63+
# save the file
64+
with open(output_file, "w") as f:
65+
for url in discovered_domains:
66+
print(url, file=f)

‎chapter-1/domain-names/google.com-subdomains.txt‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
http://www.google.com
2+
http://mail.google.com
3+
http://m.google.com
4+
http://blog.google.com
5+
http://admin.google.com
6+
http://news.google.com
7+
http://support.google.com
8+
http://mobile.google.com
9+
http://docs.google.com
10+
http://calendar.google.com
11+
http://web.google.com
12+
http://email.google.com
13+
http://images.google.com
14+
http://video.google.com
15+
http://api.google.com
16+
http://search.google.com
17+
http://chat.google.com
18+
http://wap.google.com
19+
http://sites.google.com
20+
http://ads.google.com
21+
http://apps.google.com
22+
http://download.google.com
23+
http://store.google.com
24+
http://files.google.com
25+
http://sms.google.com
26+
http://ipv4.google.com

‎chapter-1/domain-names/requirements.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
python-whois
2+
requests

‎chapter-1/domain-names/subdomain_scanner.py‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
import requests
2+
3+
# the domain to scan for subdomains
4+
domain = "thepythoncode.com"
5+
6+
# read all subdomains
7+
with open("subdomains.txt") as file:
8+
# read all content
9+
content = file.read()
10+
# split by new lines
11+
subdomains = content.splitlines()
12+
13+
# a list of discovered subdomains
14+
discovered_subdomains = []
15+
for subdomain in subdomains:
16+
# construct the url
17+
url = f"http://{subdomain}.{domain}"
18+
try:
19+
# if this raises an ERROR, that means the subdomain does not exist
20+
requests.get(url, timeout=2)
21+
except requests.ConnectionError:
22+
# if the subdomain does not exist, just pass, print nothing
23+
pass
24+
else:
25+
print("[+] Discovered subdomain:", url)
26+
# append the discovered subdomain to our list
27+
discovered_subdomains.append(url)
28+
29+
# save the discovered subdomains into a file
30+
with open("discovered_subdomains.txt", "w") as f:
31+
for subdomain in discovered_subdomains:
32+
print(subdomain, file=f)

‎chapter-1/domain-names/subdomains.txt‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
www
2+
mail
3+
ftp
4+
localhost
5+
webmail
6+
smtp
7+
pop
8+
ns1
9+
webdisk
10+
ns2
11+
cpanel
12+
whm
13+
autodiscover
14+
autoconfig
15+
m
16+
imap
17+
test
18+
ns
19+
blog
20+
pop3
21+
dev
22+
www2
23+
admin
24+
forum
25+
news
26+
vpn
27+
ns3
28+
mail2
29+
new
30+
mysql
31+
old
32+
lists
33+
support
34+
mobile
35+
mx
36+
static
37+
docs
38+
beta
39+
shop
40+
sql
41+
secure
42+
demo
43+
cp
44+
calendar
45+
wiki
46+
web
47+
media
48+
email
49+
images
50+
img
51+
www1
52+
intranet
53+
portal
54+
video
55+
sip
56+
dns2
57+
api
58+
cdn
59+
stats
60+
dns1
61+
ns4
62+
www3
63+
dns
64+
search
65+
staging
66+
server
67+
mx1
68+
chat
69+
wap
70+
my
71+
svn
72+
mail1
73+
sites
74+
proxy
75+
ads
76+
host
77+
crm
78+
cms
79+
backup
80+
mx2
81+
lyncdiscover
82+
info
83+
apps
84+
download
85+
remote
86+
db
87+
forums
88+
store
89+
relay
90+
files
91+
newsletter
92+
app
93+
live
94+
owa
95+
en
96+
start
97+
sms
98+
office
99+
exchange
100+
ipv4

‎chapter-1/geolocation/get_ip_info.py‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
import ipinfo
2+
import sys
3+
4+
# get the ip address from the command line
5+
try:
6+
ip_address = sys.argv[1]
7+
except IndexError:
8+
ip_address = None
9+
10+
# access token for ipinfo.io
11+
access_token = '09d8c3fe6f8ed9'
12+
# create a client object with the access token
13+
handler = ipinfo.getHandler(access_token)
14+
# get the ip info
15+
details = handler.getDetails(ip_address)
16+
# print the ip info
17+
for key, value in details.all.items():
18+
print(f"{key}: {value}")

‎chapter-1/geolocation/requirements.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ipinfo

0 commit comments

Comments
 (0)