xx
3 years ago
parent
d002bc02d7
commit
45b2e15fcb
@ -0,0 +1,175 @@ |
|||||||
|
## ksubdomain <https://github.com/knownsec/ksubdomain> |
||||||
|
<!--auto_detail_badge_begin_0b490ffb61b26b45de3ea5d7dd8a582e--> |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
<!--auto_detail_badge_end_fef74f2d7ea73fcc43ff78e05b1e7451--> |
||||||
|
|
||||||
|
|
||||||
|
ksubdomain是一款基于无状态子域名爆破工具，支持在Windows/Linux/Mac上使用，它会很快的进行DNS爆破，在Mac和Windows上理论最大发包速度在30w/s,linux上为160w/s的速度。 |
||||||
|
## 为什么这么快 |
||||||
|
ksubdomain的发送和接收是分离且不依赖系统，即使高并发发包，也不会占用系统描述符让系统网络阻塞。 |
||||||
|
|
||||||
|
可以用`--test`来测试本地最大发包数,但实际发包的多少和网络情况息息相关，ksubdomain将网络参数简化为了`-b`参数，输入你的网络下载速度如`-b 5m`，ksubdomain将会自动限制发包速度。 |
||||||
|
## 可靠性 |
||||||
|
类似masscan,这么大的发包速度意味着丢包也会非常严重，ksubdomain有丢包重发机制(这样意味着速度会减小，但比普通的DNS爆破快很多)，会保证每个包都收到DNS服务器的回复，漏报的可能性很小。 |
||||||
|
|
||||||
|
## 使用 |
||||||
|
从[releases](https://github.com/knownsec/ksubdomain/releases "releases")下载二进制文件。 |
||||||
|
|
||||||
|
在linux下，还需要安装`libpcap-dev`,在Windows下需要安装`WinPcap`，mac下可以直接使用。 |
||||||
|
``` |
||||||
|
_ __ _____ _ _ _ |
||||||
|
| |/ / / ____| | | | | (_) |
||||||
|
| ' / | (___ _ _| |__ __| | ___ _ __ ___ __ _ _ _ __ |
||||||
|
| < \___ \| | | | '_ \ / _| |/ _ \| '_ _ \ / _ | | '_ \ |
||||||
|
| . \ ____) | |_| | |_) | (_| | (_) | | | | | | (_| | | | | | |
||||||
|
|_|\_\ |_____/ \__,_|_.__/ \__,_|\___/|_| |_| |_|\__,_|_|_| |_| |
||||||
|
|
||||||
|
[INFO] Current Version: 0.7 |
||||||
|
Usage of ./cmd: |
||||||
|
-api |
||||||
|
使用网络接口 |
||||||
|
-b string |
||||||
|
宽带的下行速度，可以5M,5K,5G (default "1M") |
||||||
|
-check-origin |
||||||
|
会从返回包检查DNS是否为设定的，防止其他包的干扰 |
||||||
|
-csv |
||||||
|
输出excel文件 |
||||||
|
-d string |
||||||
|
爆破域名 |
||||||
|
-dl string |
||||||
|
从文件中读取爆破域名 |
||||||
|
-e int |
||||||
|
默认网络设备ID,默认-1，如果有多个网络设备会在命令行中选择 (default -1) |
||||||
|
-f string |
||||||
|
字典路径,-d下文件为子域名字典，-verify下文件为需要验证的域名 |
||||||
|
-filter-wild |
||||||
|
自动分析并过滤泛解析，最终输出文件，需要与'-o'搭配 |
||||||
|
-full |
||||||
|
完整模式，使用网络接口和内置字典 |
||||||
|
-l int |
||||||
|
爆破域名层级,默认爆破一级域名 (default 1) |
||||||
|
-list-network |
||||||
|
列出所有网络设备 |
||||||
|
-o string |
||||||
|
输出文件路径 |
||||||
|
-s string |
||||||
|
resolvers文件路径,默认使用内置DNS |
||||||
|
-sf string |
||||||
|
三级域名爆破字典文件(默认内置) |
||||||
|
-silent |
||||||
|
使用后屏幕将仅输出域名 |
||||||
|
-skip-wild |
||||||
|
跳过泛解析的域名 |
||||||
|
-summary |
||||||
|
在扫描完毕后整理域名归属asn以及IP段 |
||||||
|
-test |
||||||
|
测试本地最大发包数 |
||||||
|
-ttl |
||||||
|
导出格式中包含TTL选项 |
||||||
|
-verify |
||||||
|
验证模式 |
||||||
|
|
||||||
|
``` |
||||||
|
### 常用命令 |
||||||
|
``` |
||||||
|
使用内置字典爆破 |
||||||
|
ksubdomain -d seebug.org |
||||||
|
|
||||||
|
使用字典爆破域名 |
||||||
|
ksubdomain -d seebug.org -f subdomains.dict |
||||||
|
|
||||||
|
字典里都是域名，可使用验证模式 |
||||||
|
ksubdomain -f dns.txt -verify |
||||||
|
|
||||||
|
爆破三级域名 |
||||||
|
ksubdomain -d seebug.org -l 2 |
||||||
|
|
||||||
|
通过管道爆破 |
||||||
|
echo "seebug.org"|ksubdomain |
||||||
|
|
||||||
|
通过管道验证域名 |
||||||
|
echo "paper.seebug.org"|ksubdomain -verify |
||||||
|
|
||||||
|
仅使用网络API接口获取域名 |
||||||
|
ksubdomain -d seebug.org -api |
||||||
|
|
||||||
|
完整模式,先使用网络API，在此基础使用内置字典进行爆破 |
||||||
|
ksubdomain -d seebug.org -full |
||||||
|
``` |
||||||
|
[](https://asciinema.org/a/356138) |
||||||
|
## Summary整理 |
||||||
|
ksubdomain加入了整理的功能，当参数后面加上`-summary`。 |
||||||
|
|
||||||
|
例如`ksubdomain -d seebug.org -summary`之后，会根据域名归属的asn以及IP段自动整理输出，方便确认资产的范围。 |
||||||
|
|
||||||
|
 |
||||||
|
|
||||||
|
|
||||||
|
## 管道操作 |
||||||
|
借助知名的`subfinder`，`httpx`等工具，可以用管道结合在一起配合工作。达到收集域名，验证域名，http验证存活目的。 |
||||||
|
```bash |
||||||
|
./subfinder -d baidu.com -silent|./ksubdomain -verify -silent|./httpx -title -content-length -status-code |
||||||
|
``` |
||||||
|
- subfinder 通过各种搜索引擎获取域名 |
||||||
|
- ksubdomain 验证域名 |
||||||
|
- httpx http请求获得数据,验证存活 |
||||||
|
 |
||||||
|
|
||||||
|
## 编译 |
||||||
|
因为pcap包的特殊性，无法交叉编译，只能每个系统编译每个文件。 |
||||||
|
```bash |
||||||
|
git clone https://github.com/knownsec/ksubdomain |
||||||
|
cd ksubdomain |
||||||
|
go mod download |
||||||
|
cd cmd |
||||||
|
go build ksubdomain.go |
||||||
|
``` |
||||||
|
|
||||||
|
## Script编写 |
||||||
|
Ksubdomain 网络API引擎脚本使用`lua`，文件路径在`resources/scripts` |
||||||
|
 |
||||||
|
```lua |
||||||
|
name = "Sublist3rAPI" -- * 插件名称(必须) |
||||||
|
type = "api" -- 插件类型(不必须) |
||||||
|
|
||||||
|
local json = require("json") |
||||||
|
|
||||||
|
function buildurl(domain) |
||||||
|
return "https://api.sublist3r.com/search.php?domain=" .. domain |
||||||
|
end |
||||||
|
|
||||||
|
-- 需要实现一个vertical函数，返回类型为一个域名的table，如果失败可以返回nil |
||||||
|
function vertical(domain) |
||||||
|
local page, err = request({url=buildurl(domain)}) |
||||||
|
if (err ~= nil and err ~= "") then |
||||||
|
return |
||||||
|
end |
||||||
|
local resp = json.decode(page) |
||||||
|
if (resp == nil or #resp == 0) then |
||||||
|
return |
||||||
|
end |
||||||
|
local a = {} |
||||||
|
for i, v in pairs(resp) do |
||||||
|
table.insert(a, v) |
||||||
|
end |
||||||
|
return a |
||||||
|
end |
||||||
|
``` |
||||||
|
在编写插件完毕后，打包文件 |
||||||
|
```bash |
||||||
|
statik -src=resources |
||||||
|
``` |
||||||
|
|
||||||
|
<!--auto_detail_active_begin_e1c6fb434b6f0baf6912c7a1934f772b--> |
||||||
|
## 项目相关 |
||||||
|
|
||||||
|
- 2020-09-02 发布文章[《ksubdomain 无状态域名爆破工具》](https://paper.seebug.org/1325/) |
||||||
|
- 2019-10-12 发布文章[《从 Masscan, Zmap 源码分析到开发实践》](https://paper.seebug.org/1052/) |
||||||
|
|
||||||
|
## 最近更新 |
||||||
|
|
||||||
|
<!--auto_detail_active_end_f9cf7911015e9913b7e691a7a5878527--> |
||||||
@ -0,0 +1,156 @@ |
|||||||
|
## pocsuite3 <https://github.com/knownsec/pocsuite3> |
||||||
|
<!--auto_detail_badge_begin_0b490ffb61b26b45de3ea5d7dd8a582e--> |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
 |
||||||
|
<!--auto_detail_badge_end_fef74f2d7ea73fcc43ff78e05b1e7451--> |
||||||
|
|
||||||
|
|
||||||
|
## Legal Disclaimer |
||||||
|
Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. |
||||||
|
pocsuite3 is for security testing purposes only |
||||||
|
|
||||||
|
## 法律免责声明 |
||||||
|
未经事先双方同意，使用 pocsuite3 攻击目标是非法的。 |
||||||
|
pocsuite3 仅用于安全测试目的 |
||||||
|
|
||||||
|
## Overview |
||||||
|
|
||||||
|
pocsuite3 is an open-sourced remote vulnerability testing and proof-of-concept development framework developed by the [**Knownsec 404 Team**](http://www.knownsec.com/). |
||||||
|
It comes with a powerful proof-of-concept engine, many nice features for the ultimate penetration testers and security researchers. |
||||||
|
|
||||||
|
## Features |
||||||
|
* PoC scripts can running with `verify`, `attack`, `shell` mode in different way |
||||||
|
* Plugin ecosystem |
||||||
|
* Dynamic loading PoC script from any where (local file, redis, database, Seebug ...) |
||||||
|
* Load multi-target from any where (CIDR, local file, redis, database, Zoomeye, Shodan ...) |
||||||
|
* Results can be easily exported |
||||||
|
* Dynamic patch and hook requests |
||||||
|
* Both command line tool and python package import to use |
||||||
|
* IPV6 support |
||||||
|
* Global HTTP/HTTPS/SOCKS proxy support |
||||||
|
* Simple spider API for PoC script to use |
||||||
|
* Integrate with [Seebug](https://www.seebug.org) (for load PoC from Seebug website) |
||||||
|
* Integrate with [ZoomEye](https://www.zoomeye.org) (for load target from ZoomEye `Dork`) |
||||||
|
* Integrate with [Shodan](https://www.shodan.io) (for load target from Shodan `Dork`) |
||||||
|
* Integrate with [Ceye](http://ceye.io/) (for verify blind DNS and HTTP request) |
||||||
|
* Integrate with [Interactsh](https://github.com/projectdiscovery/interactsh) (for verify blind DNS and HTTP request) |
||||||
|
* Integrate with Fofa (for load target from Fofa `Dork`) |
||||||
|
* Friendly debug PoC scripts with IDEs |
||||||
|
* More ... |
||||||
|
|
||||||
|
## Screenshots |
||||||
|
|
||||||
|
### pocsuite3 console mode |
||||||
|
[](https://asciinema.org/a/219356) |
||||||
|
|
||||||
|
### pocsuite3 shell mode |
||||||
|
[](https://asciinema.org/a/203101) |
||||||
|
|
||||||
|
### pocsuite3 load PoC from Seebug |
||||||
|
[](https://asciinema.org/a/207350) |
||||||
|
|
||||||
|
### pocsuite3 load multi-target from ZoomEye |
||||||
|
[](https://asciinema.org/a/133344) |
||||||
|
|
||||||
|
### pocsuite3 load multi-target from Shodan |
||||||
|
[](https://asciinema.org/a/207349) |
||||||
|
|
||||||
|
## Requirements |
||||||
|
|
||||||
|
- Python 3.6+ |
||||||
|
- Works on Linux, Windows, Mac OSX, BSD, etc. |
||||||
|
|
||||||
|
## Installation |
||||||
|
|
||||||
|
Paste at a terminal prompt: |
||||||
|
|
||||||
|
### Python pip |
||||||
|
|
||||||
|
``` bash |
||||||
|
pip3 install pocsuite3 |
||||||
|
|
||||||
|
# use other pypi mirror |
||||||
|
pip3 install -i https://pypi.tuna.tsinghua.edu.cn/simple pocsuite3 |
||||||
|
``` |
||||||
|
|
||||||
|
### MacOS |
||||||
|
|
||||||
|
``` bash |
||||||
|
brew update |
||||||
|
brew info pocsuite3 |
||||||
|
brew install pocsuite3 |
||||||
|
``` |
||||||
|
|
||||||
|
### [Debian](https://tracker.debian.org/pkg/pocsuite3), [Ubuntu](https://launchpad.net/ubuntu/+source/pocsuite3), [Kali](http://pkg.kali.org/pkg/pocsuite3) |
||||||
|
|
||||||
|
``` bash |
||||||
|
sudo apt update |
||||||
|
sudo apt install pocsuite3 |
||||||
|
``` |
||||||
|
|
||||||
|
### ArchLinux |
||||||
|
|
||||||
|
``` bash |
||||||
|
yay pocsuite3 |
||||||
|
``` |
||||||
|
|
||||||
|
### |
||||||
|
|
||||||
|
Or click [here](https://github.com/knownsec/pocsuite3/archive/master.zip) to download the latest source zip package and extract |
||||||
|
|
||||||
|
``` bash |
||||||
|
$ wget https://github.com/knownsec/pocsuite3/archive/master.zip |
||||||
|
$ unzip master.zip |
||||||
|
$ cd pocsuite3-master |
||||||
|
$ pip3 install -r requirements.txt |
||||||
|
$ python3 setup.py install |
||||||
|
``` |
||||||
|
|
||||||
|
|
||||||
|
The latest version of this software is available at: https://pocsuite.org |
||||||
|
|
||||||
|
## Documentation |
||||||
|
|
||||||
|
Documentation is available in the [```docs```](https://github.com/knownsec/pocsuite3/blob/master/docs) directory. |
||||||
|
|
||||||
|
## Usage |
||||||
|
|
||||||
|
``` |
||||||
|
cli mode |
||||||
|
|
||||||
|
# basic usage, use -v to set the log level |
||||||
|
pocsuite -u http://example.com -r example.py -v 2 |
||||||
|
|
||||||
|
# run poc with shell mode |
||||||
|
pocsuite -u http://example.com -r example.py -v 2 --shell |
||||||
|
|
||||||
|
# search for the target of redis service from ZoomEye and perform batch detection of vulnerabilities. The thread is set to 20 |
||||||
|
pocsuite -r redis.py --dork service:redis --threads 20 |
||||||
|
|
||||||
|
# load all poc in the poc directory and save the result as html |
||||||
|
pocsuite -u http://example.com --plugins poc_from_pocs,html_report |
||||||
|
|
||||||
|
# load the target from the file, and use the poc under the poc directory to scan |
||||||
|
pocsuite -f batch.txt --plugins poc_from_pocs,html_report |
||||||
|
|
||||||
|
# load CIDR target |
||||||
|
pocsuite -u 10.0.0.0/24 -r example.py --plugins target_from_cidr |
||||||
|
|
||||||
|
# the custom parameters `command` is implemented in ecshop poc, which can be set from command line options |
||||||
|
pocsuite -u http://example.com -r ecshop_rce.py --attack --command "whoami" |
||||||
|
|
||||||
|
console mode |
||||||
|
poc-console |
||||||
|
``` |
||||||
|
|
||||||
|
|
||||||
|
<!--auto_detail_active_begin_e1c6fb434b6f0baf6912c7a1934f772b--> |
||||||
|
## 项目相关 |
||||||
|
|
||||||
|
|
||||||
|
## 最近更新 |
||||||
|
|
||||||
|
<!--auto_detail_active_end_f9cf7911015e9913b7e691a7a5878527--> |
||||||
Loading…
Reference in new issue