def checklistdomain(self,threads): # threading to check all domain for i in range(threads): thread = Thread(target = self.checkdomain, args = ()) self.threadlist.append(thread) thread.start() for thread in self.threadlist: thread.join() self.frmwk.print_line('')
def worker(self, rhost): self.domains = [] self.victim = rhost try: self.ip = gethostbyname(self.victim) except: self.frmwk.print_error('Cann\' get IP Address') return False self.domains.append(self.victim) if self.ip in CONFIG.IP_WHITE_LIST: self.frmwk.print_error('Site down!') return False self.threadlist = [] self.frmwk.print_status("IP : %s" % self.ip) self.frmwk.print_line("-------------------------------------------") for searcher in self.SEARCHERS: thread = Thread(target=self.reverseip, args=(searcher, )) self.threadlist.append(thread) thread.start() for thread in self.threadlist: try: thread.join(CONFIG.TIME_OUT) if thread.isAlive(): thread.terminate() except timeout: self.frmwk.print_error('Exception Timeout') pass self.frmwk.print_line("-------------------------------------------\n") #import from db if self.frmwk.dbconnect: self.frmwk.print_status('Getting subdomain in database') cursor = self.frmwk.dbconnect.db.cursor() iprow = getIP(cursor, self.ip) if iprow: dmrow = getDomain(cursor, ['domain_name'], {'ip_id_list': '%%!%s|%%' % iprow[0]}) for dm in dmrow: self.domains.append(dm[0]) cursor.close() self.domains = sortlistdomain(self.domains) if self.options['CHECK']: self.frmwk.print_status('Checking domain\'s in this IP') checker = checkdomains(self.frmwk, self.ip, self.domains) checker.checklistdomain(self.options['THREADS']) self.domains = sorted(list(set(checker.response))) if self.frmwk.dbconnect and self.options['CHECK']: self.frmwk.print_status('Saving database!') self.Saver() self.frmwk.print_success('List domain:') self.frmwk.print_line("----------------") self.frmwk.print_line("\n".join(self.domains)) return True
def getListIP(self, subs, thread = 1): self.listip = {} self.subs = subs threads = [] self.sublen = len(subs) self.len = 0 for i in range(thread): t = Thread(target = self.getIPThread) threads.append(t) t.start() for t in threads: t.join() print_line() return self.listip
def run(self, frmwk, args): self.frmwk = frmwk self.victim = HTTP(self.options['URL'], timeout=self.advanced_options['TIMEOUT']) self.victim.storecookie = True self.verbose = self.options['VERBOSE'] self.userlist = [] self.passlist = [] self.success = [] self.victim.headers.update({'Cookie': self.advanced_options['COOKIE']} if self.advanced_options['COOKIE'] else {}) ####################################### if self.options['USERNAME']: self.userlist = self.options['USERNAME'].split(',') else: self.userlist = ReadFromFile(FullPath(self.options['USERLIST'])) if self.options['PASSWORD']: self.passlist = self.options['PASSWORD'].split(',') else: for a in ReadFromFile(FullPath(self.options['PASSLIST'])): self.passlist.append(a) self.lenuser = len(self.userlist) self.lenpass = len(self.passlist) ############################################### listthread = [] if len(self.userlist) > 0: self.temppass = [] for i in range(self.options['THREADS']): t = Thread(target=self.worker) listthread.append(t) t.start() try: for t in listthread: t.join() except KeyboardInterrupt: for t in listthread: if t.isAlive(): t.terminate() pass ############################################## self.success = sorted(self.success) self.frmwk.print_line() self.frmwk.print_status("List login:\n-----------") if len(self.success) > 0: for u, p in self.success: self.frmwk.print_success( 'SUCCESS: username: {0:<20} password: {1}'.format( u, p)) self.frmwk.print_status("-----------") else: self.frmwk.print_status('Nothing to do!')
def worker(self, rhost): self.domains = [] self.victim = rhost try: self.ip = gethostbyname(self.victim) except: self.frmwk.print_error('Cann\' get IP Address') return False self.domains.append(self.victim) if self.ip in CONFIG.IP_WHITE_LIST: self.frmwk.print_error('Site down!') return False self.threadlist = [] self.frmwk.print_status("IP : %s" % self.ip) self.frmwk.print_line("-------------------------------------------") for searcher in self.SEARCHERS: thread = Thread(target = self.reverseip, args = (searcher,)) self.threadlist.append(thread) thread.start() for thread in self.threadlist: try: thread.join(CONFIG.TIME_OUT) if thread.isAlive(): thread.terminate() except timeout: self.frmwk.print_error('Exception Timeout') pass self.frmwk.print_line("-------------------------------------------\n") #import from db if self.frmwk.dbconnect: self.frmwk.print_status('Getting subdomain in database') cursor = self.frmwk.dbconnect.db.cursor() iprow = getIP(cursor, self.ip) if iprow: dmrow = getDomain(cursor, ['domain_name'], {'ip_id_list': '%%!%s|%%' % iprow[0]}) for dm in dmrow: self.domains.append(dm[0]) cursor.close() self.domains = sortlistdomain(self.domains) if self.options['CHECK']: self.frmwk.print_status('Checking domain\'s in this IP') checker = checkdomains(self.frmwk, self.ip, self.domains) checker.checklistdomain(self.options['THREADS']) self.domains = sorted(list(set(checker.response))) if self.frmwk.dbconnect and self.options['CHECK']: self.frmwk.print_status('Saving database!') self.Saver() self.frmwk.print_success('List domain:') self.frmwk.print_line("----------------") self.frmwk.print_line("\n".join(self.domains)) return True
def scanner(self, host): try: for p in self.ports: self.frmwk.print_status("[SCANNING]\tHost : " + host + "\tPort : " + str(p)) try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) s.settimeout(self.timeout) s.connect((host, p)) s.shutdown(socket.SHUT_RDWR) self.result.append([host, p]) self.frmwk.print_success("[OPEN]\tHost : " + host + "\tPort : " + str(p)) except socket.timeout: self.frmwk.print_error("[CLOSE]\tHost : " + host + "\tPort : " + str(p)) except: self.frmwk.print_error("Connect error !") finally: s.close() if self.thread_flag: Thread(target=self.threader).start() except KeyboardInterrupt: pass
def filechecker(self, dirpath): self.tmp_files = self.files + [] threads = [] for i in range(self.thread): t = Thread(target=self.checkfile, args=(dirpath, )) threads.append(t) t.start() try: for t in threads: t.join() except KeyboardInterrupt: for t in threads: if t.isAlive(): t.terminate() pass
def run(self, frmwk, args): self.frmwk = frmwk self.victim = HTTP(self.options["URL"], timeout=self.advanced_options["TIMEOUT"]) self.victim.storecookie = True self.verbose = self.options["VERBOSE"] self.userlist = [] self.passlist = [] self.success = [] self.victim.headers.update( {"Cookie": self.advanced_options["COOKIE"]} if self.advanced_options["COOKIE"] else {} ) ####################################### if self.options["USERNAME"]: self.userlist = self.options["USERNAME"].split(",") else: self.userlist = ReadFromFile(FullPath(self.options["USERLIST"])) if self.options["PASSWORD"]: self.passlist = self.options["PASSWORD"].split(",") else: for a in ReadFromFile(FullPath(self.options["PASSLIST"])): self.passlist.append(a) self.lenuser = len(self.userlist) self.lenpass = len(self.passlist) ############################################### listthread = [] if len(self.userlist) > 0: self.temppass = [] for i in range(self.options["THREADS"]): t = Thread(target=self.worker) listthread.append(t) t.start() try: for t in listthread: t.join() except KeyboardInterrupt: for t in listthread: if t.isAlive(): t.terminate() pass ############################################## self.success = sorted(self.success) self.frmwk.print_line() self.frmwk.print_status("List login:\n-----------") if len(self.success) > 0: for u, p in self.success: self.frmwk.print_success("SUCCESS: username: {0:<20} password: {1}".format(u, p)) self.frmwk.print_status("-----------") else: self.frmwk.print_status("Nothing to do!")
def checklistdomain(self, threads): # threading to check all domain for i in range(threads): thread = Thread(target=self.checkdomain, args=()) self.threadlist.append(thread) thread.start() for thread in self.threadlist: thread.join() self.frmwk.print_line('')
def filechecker(self, dirpath): self.tmp_files = list(self.files) + [] threads = [] for i in range(self.thread): t = Thread(target = self.checkfile, args = (dirpath,)) threads.append(t) t.start() try: for t in threads: t.join() except KeyboardInterrupt: for t in threads: if t.isAlive(): t.terminate() pass
def tunnel_server(self): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1) try: sock.bind((self.server_host, self.server_port)) sock.listen(5) self.frmwk.print_status("Server listen on port : " + str(self.server_port)) while True: conn, addr = sock.accept() Thread(target=self.worker, args=( conn, addr, )).start() finally: sock.close()
def scanner(self, host): self.frmwk.print_status("[SCANNING]\tHost : " + host + "\tPort : " + self.port) try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) s.settimeout(self.timeout) s.connect((host, int(self.port))) s.shutdown(socket.SHUT_RDWR) port = "[OPEN]\tHost : " + host + "\tPort : " + self.port self.ports.append(port) self.frmwk.print_success(port) try: if path.exists(self.restore_file): unlink(self.restore_file) self.frmwk.print_status("[SCANNING]\tHost : " + host) hydra = self.hydra + ' -F -W ' + self.delay + ' -w ' + str( self.timeout ) + ' -t 1 -C \'' + self.accounts + '\' ' + host + ' ' + self.service self.frmwk.print_line(hydra) proc = Popen(hydra, shell=True, stderr=PIPE, stdout=PIPE) ret_code = proc.wait() except KeyboardInterrupt: proc.kill() for line in proc.stdout: line = line.decode("utf-8").strip() self.frmwk.print_line(line) if line.find(' password: ') != -1: self.result.append(line) self.frmwk.print_success(line) except socket.timeout: self.frmwk.print_error("[CLOSE]\tHost : " + host + "\tPort : " + self.port) except: self.frmwk.print_error("Connect error !") self.thread_flag = False finally: s.close() if self.thread_flag: Thread(target=self.threader).start()
def getListIP(self, subs, thread=1): self.listip = {} self.subs = subs threads = [] self.sublen = len(subs) self.len = 0 for i in range(thread): t = Thread(target=self.getIPThread) threads.append(t) t.start() for t in threads: t.join() print_line() return self.listip
def gets(self, domains, thread=1): self.ips = {} self.domains = domains self.sublen = len(domains) self.len = 0 for i in range(thread): t = Thread(target=self.get_parallel) self.threads.append(t) t.start() for t in self.threads: t.join() print_line() return self.ips
def run(self, frmwk, args): self.frmwk = frmwk self.dirs = read_from_file(full_path( self.options['DIRLIST'])) if self.options['DIRLIST'] else [] self.files = read_from_file(full_path( self.options['FILELIST'])) if self.options['FILELIST'] else [] self.url = self.options['URL'] if self.options['URL'].endswith( '/') else self.options['URL'] + '/' self.type = self.options['TYPE'] self.thread = self.options['THREADS'] self.stop = self.options['STOP'] self.extension = self.options['EXTENSION'].split(',') self.timeout = self.advanced_options['TIMEOUT'] self.into = self.advanced_options['INTO'] self.victim = HTTP(self.url, timeout=self.timeout) self.victim.headers.update({'Cookie': self.advanced_options['COOKIE']} if self.advanced_options['COOKIE'] else {}) self.success = [] self.tmp_dirs = self.dirs + [] self.current_dir = '' self.locker = Lock() if self.type in ['lenght', 'auto']: victim = deepcopy(self.victim) victim.redirect = False self.frmwk.print_status('Init not found infomation') victim.Request(self.url + 'ASDASdadhkjlhjfasdfawefa/', 'GET') if self.type == 'auto': # if victim.response.status == 404: # self.type = 'status' # self.frmwk.print_success('auto get type: error') # el if victim.response.status == 200: self.type = 'lenght' self.frmwk.print_success('auto get type: lenght') else: self.type = 'location' self.frmwk.print_success('auto get type: location') if self.type == 'lenght': self.notfounddir = len(victim.result) if self.type in ['lenght', 'location']: self.notfoundfile = len( victim.Request( self.url + 'adfasdaszxcvzdczxfasASasda.' + self.extension[0], 'GET')) self.offset = self.advanced_options['OFFSET'] del victim if self.type == 'location': self.victim.redirect = False self.frmwk.print_status('Starting scanner') ########check file in current path###### try: if self.url.endswith('/'): self.url = self.url[:-1] self.filechecker(self.url) if not self.url.endswith('/'): self.url = self.url + '/' ######################################## threads = [] for i in range(self.thread): t = Thread(target=self.worker) threads.append(t) t.start() for t in threads: t.join() except KeyboardInterrupt: for t in threads: if t.isAlive(): t.terminate() pass if len(self.success) > 0: self.frmwk.print_success('Found list:\n-----------') for link in self.success: self.frmwk.print_success(link) else: self.frmwk.print_error('---------\nNot Found!\n---------')
def run(self, frmwk, args): self.frmwk = frmwk self.dirs = ReadFromFile(FullPath(self.options['DIRLIST'])) if self.options['DIRLIST'] else [] self.files = ReadFromFile(FullPath(self.options['FILELIST'])) if self.options['FILELIST'] else [] self.url = self.options['URL'] if self.options['URL'].endswith('/') else self.options['URL'] + '/' self.type = self.options['TYPE'] self.thread = self.options['THREADS'] self.stop = self.options['STOP'] self.extension = self.options['EXTENSION'].split(',') self.timeout = self.advanced_options['TIMEOUT'] self.into = self.advanced_options['INTO'] self.victim = HTTP(self.url, timeout = self.timeout) self.victim.headers.update({'Cookie': self.advanced_options['COOKIE']} if self.advanced_options['COOKIE'] else {}) self.success = [] self.tmp_dirs = list(self.dirs) + [] self.current_dir = '' self.locker = Lock() if self.type in ['lenght', 'auto']: victim = deepcopy(self.victim) victim.redirect = False self.frmwk.print_status('Init not found infomation') victim.Request(self.url + 'ASDASdadhkjlhjfasdfawefa/', 'GET') if self.type == 'auto': # if victim.response.status == 404: # self.type = 'status' # self.frmwk.print_success('auto get type: error') # el if victim.response.status == 200: self.type = 'lenght' self.frmwk.print_success('auto get type: lenght') else: self.type = 'location' self.frmwk.print_success('auto get type: location') if self.type == 'lenght': self.notfounddir = len(victim.result) if self.type in ['lenght', 'location']: self.notfoundfile = len(victim.Request(self.url + 'adfasdaszxcvzdczxfasASasda.' + self.extension[0], 'GET')) self.offset = self.advanced_options['OFFSET'] del victim if self.type == 'location': self.victim.redirect = False self.frmwk.print_status('Starting scanner') ########check file in current path###### try: if self.url.endswith('/'): self.url = self.url[:-1] self.filechecker(self.url) if not self.url.endswith('/'): self.url = self.url + '/' ######################################## threads = [] for i in range(self.thread): t = Thread(target = self.worker) threads.append(t) t.start() for t in threads: t.join() except KeyboardInterrupt: for t in threads: if t.isAlive(): t.terminate() pass if len(self.success) > 0: self.frmwk.print_success('Found list:\n-----------') for link in self.success: self.frmwk.print_success(link) else: self.frmwk.print_error('---------\nNot Found!\n---------')
def worker(self, domain): self.subs = [domain] self.emails = [] self.ips = {} ################################################## subbrute = [] for ext in ['.', '-', '']: for sub in self.subbrute: subbrute.append(sub + ext + domain) if len(subbrute) > 0: self.frmwk.print_status( 'Starting bruteforce subdomain on thread %d' % self.brutethread) self.ips = self.ip_helper.gets(subbrute, self.brutethread) del subbrute ################################################## self.frmwk.print_status("%s : Start search enginee !" % domain) keywork = '"@%s" ext:(%s)' % (domain, ' OR '.join(CONFIG.EXTENSION)) self.frmwk.print_status('Keywork: %s' % keywork) searcher = None if "google" in self.searcher or self.searcher is "all": searcher = google.Google(keywork, self.limit, self.delay) if "yahoo" in self.searcher or self.searcher is "all": searcher = yahoo.yahoo(keywork, self.limit, self.delay) if "bing" in self.searcher or self.searcher is "all": searcher = bing.bing(keywork, self.limit, self.delay) if "baidu" in self.searcher or self.searcher is "all": searcher = baidu.baidu('"@' + domain + '"', self.limit, self.delay) if "exalead" in self.searcher or self.searcher is "all": searcher = exalead.exalead(keywork, self.limit, self.delay) if searcher: searcher.start() self.threads.append(searcher) ################################################## for t in self.threads: t.join() self.frmwk.print_status("Harvesting : <[ {0:<25} {1:d}".format( t.name, len(t.content))) if self.multithread: ps = Thread(target=filter.filter, args=( domain, t.content, self.type, )) self.docsthreads.append(ps) ps.start() else: s, e = filter.filter(domain, t.content, self.type) self.subs += s self.emails += e if len(self.docsthreads) > 0: for ps in self.docsthreads: s, e = ps.join() self.subs += s self.emails += e self.subs.append(domain) self.subs = sorted(list(set(self.subs))) self.emails = sorted(list(set(self.emails))) ############ check subdomain ############## self.frmwk.print_status('Checking subdomain in : %d thread' % self.brutethread) ips = self.ip_helper.gets(self.subs, self.brutethread) for ip in ips.keys(): if ip in self.ips: self.ips[ip] = sorted(list(set(self.ips[ip] + ips[ip]))) else: self.ips[ip] = ips[ip] del ips ################# reverse ip ############### if self.reverse_ip: for ip in self.ips.keys(): rev_ip = self.frmwk.modules['info/reverse_ip'] rev_ip.options.add_string( 'RHOST', 'IP/Domain to reverse(support : ip1,ip2...)', default=ip) rev_ip.options.add_boolean('CHECK', 'check domain is in this IP ', default=True) rev_ip.options.add_integer('THREADS', 'thread check domain', default=10) ############################ rev_ip.advanced_options.add_path('HOSTLIST', 'Path to domain list', False) rev_ip.advanced_options.add_path('OUTPUT', 'Output directory', False) rev_ip.run(self.frmwk, None) self.frmwk.reload_module('info/reverse_ip') for d in rev_ip.domains: if d.endswith(domain): self.ips[ip].append(d) self.ips[ip] = sorted(list(set(self.ips[ip]))) ########################################### self.frmwk.print_line() self.frmwk.print_success( "Hosts found in search engines:\n------------------------------") for ip in self.ips.keys(): self.frmwk.print_success('IP Server : ' + ip) for dm in self.ips[ip]: self.frmwk.print_line('\t. ' + dm) self.frmwk.print_line() self.frmwk.print_line() self.frmwk.print_success("Emails found:\n-------------") self.frmwk.print_line("\n".join(self.emails)) self.frmwk.print_line('')
def threader(self): self.thread_lock.acquire() if(len(self.hosts) > 0): t = Thread(target = self.scanner, args = (self.hosts.pop(0),)) t.start() self.list_threads.append(t) else: try: self.thread_flag = False for t in self.list_threads: if t.isAlive(): t.join(self.timeout * len(self.ports) + 5) if t.isAlive(): t.terminate() except: for t in self.list_threads: if t.isAlive(): t.terminate() self.lock.release() self.thread_lock.release()
def worker(self, domain): threads = [] self.subs = [domain] self.emails = [] self.listip = {} ################################################## subbrute = [] for ext in ['.', '-', '']: for sub in self.subbrute: subbrute.append(sub + ext + domain) if len(subbrute) > 0: self.frmwk.print_status('Starting bruteforce subdomain in : %d thread' % self.subbrutethread) self.listip = IP().getListIP(subbrute, self.subbrutethread) del subbrute ################################################## if self.options['TYPE'].strip().lower() == "fast": type = 2 elif self.options['TYPE'].strip().lower() == "slow": type = 0 else: type = 1 ################################################## self.frmwk.print_status("%s : Start search enginee !" % domain) keywork = '"@' + domain + '" ext:(' + ' OR '.join(CONFIG.EXTENSION) + ')' if self.searcher in ("yahoo", "all"): yh = yahoo.yahoo(keywork, self.limit, self.delay) yh.start() threads.append(yh) if self.searcher in ("bing", "all"): bg = bing.bing(keywork, self.limit, self.delay) bg.start() threads.append(bg) if self.searcher in ("baidu", "all"): bd = baidu.baidu('"@' + domain + '"', self.limit, self.delay) bd.start() threads.append(bd) if self.searcher in ("exalead", "all"): el = exalead.exalead(keywork, self.limit, self.delay) el.start() threads.append(el) if self.searcher in ("google", "all"): gg = google.google(keywork, self.limit, self.delay) gg.start() threads.append(gg) ############### get info from db ################## if self.frmwk.dbconnect: self.frmwk.print_status('Getting data in database') cursor = self.frmwk.dbconnect.db.cursor() dmrow = getDomain(cursor, ['domain_name', 'mail_list'], {'domain_name': '%%%s' % domain}) if dmrow: for dm in dmrow: self.subs.append(dm[0]) if dm[1]: for e in dm[1].split('\n'): self.emails.append(e.split('|')[0].strip()) else: self.frmwk.print_status('Nothing in Database!') cursor.close() else: self.frmwk.print_error('Database connect false!') ################################################## docsthreads = [] try: for t in threads: t.join() self.frmwk.print_status("Harvesting : <[ {0:<25} {1:d}".format(t.name, len(t.info))) if self.multithread: ps = Thread(target = filter.Filter, args = (domain, t.info, type,)) docsthreads.append(ps) ps.start() else: s,e = filter.Filter(domain, t.info, type) self.subs += s self.emails += e except KeyboardInterrupt: for t in threads: if t.isAlive(): t.terminate() for t in docsthreads: if t.isAlive(): t.terminate() pass if len(docsthreads) > 0: for ps in docsthreads: s,e = ps.join() self.subs += s self.emails += e self.subs.append(domain) self.subs = sorted(list(set(self.subs))) self.emails = sorted(list(set(self.emails))) ############ check subdomain ############## self.frmwk.print_status('Checking subdomain in : %d thread' % self.subbrutethread) ips = IP().getListIP(self.subs, self.subbrutethread) for ip in ips.keys(): if ip in self.listip: self.listip[ip] = sorted(list(set(self.listip[ip] + ips[ip]))) else: self.listip[ip] = ips[ip] del ips ################ insert db ################# if self.frmwk.dbconnect: self.frmwk.print_status('start save database!') self.DBInsert(domain) ################# reverse ip ############### if self.reverseip: for ip in self.listip.keys(): reip = self.frmwk.modules['info/reverse_ip'] reip.options.addString('RHOST', 'IP/Domain to reverse(support : ip1,ip2...)', default = ip) reip.options.addBoolean('CHECK', 'check domain is in this IP ', default = True) reip.options.addInteger('THREADS', 'thread check domain', default = 10) ############################ reip.advanced_options.addPath('HOSTLIST', 'Path to domain list', False) reip.advanced_options.addPath('OUTPUT', 'Output directory', False) reip.run(self.frmwk, None) self.frmwk.reload_module('info/reverse_ip') for d in reip.domains: if d.endswith(domain): self.listip[ip].append(d) self.listip[ip] = sorted(list(set(self.listip[ip]))) ########################################### self.frmwk.print_line() self.frmwk.print_success("Hosts found in search engines:\n------------------------------") for ip in self.listip.keys(): self.frmwk.print_success('IP Server : ' + ip) for dm in self.listip[ip]: self.frmwk.print_line('\t. ' + dm) self.frmwk.print_line() self.frmwk.print_line() self.frmwk.print_success("Emails found:\n-------------") self.frmwk.print_line("\n".join(self.emails)) self.frmwk.print_line('')
def threader(self): self.thread_lock.acquire() if(len(self.hosts) > 0): t = Thread(target = self.scanner, args = (self.hosts.pop(0),)) t.start() self.list_threads.append(t) else: try: self.thread_flag = False for t in self.list_threads: if t.isAlive(): t.join(self.timeout * len(self.accounts) + 5) if t.isAlive(): t.terminate() except: for t in self.list_threads: if t.isAlive(): t.terminate() self.lock.release() self.thread_lock.release()