Merge pull request #29 from Mzack9999/bing-passive-search

Added Bing passive search

libsubfinder/engines/passive/passive.go

@@ -35,6 +35,7 @@ import (
 	"github.com/Ice3man543/subfinder/libsubfinder/sources/virustotal"
 	"github.com/Ice3man543/subfinder/libsubfinder/sources/waybackarchive"
 	"github.com/Ice3man543/subfinder/libsubfinder/sources/baidu"
+	"github.com/Ice3man543/subfinder/libsubfinder/sources/bing"
 	"github.com/Ice3man543/subfinder/libsubfinder/sources/ask"
 )
 
@@ -59,6 +60,7 @@ type Source struct {
 	Riddler        bool
 	Dnsdb          bool
 	Baidu          bool
+	Bing           bool
 	Ask            bool
 
 	NoOfSources int
@@ -90,6 +92,7 @@ func PassiveDiscovery(state *helper.State) (finalPassiveSubdomains []string) {
 			fmt.Printf("\n[-] Searching For Subdomains in Netcraft")
 			fmt.Printf("\n[-] Searching For Subdomains in Dnsdb")
 			fmt.Printf("\n[-] Searching For Subdomains in Baidu")
+			fmt.Printf("\n[-] Searching For Subdomains in Bing")
 			fmt.Printf("\n[-] Searching For Subdomains in Ask\n")
 		}
 
@@ -207,6 +210,11 @@ func PassiveDiscovery(state *helper.State) (finalPassiveSubdomains []string) {
 				}
 				sourceConfig.Baidu = true
 				sourceConfig.NoOfSources = sourceConfig.NoOfSources + 1
+			} else if source == "bing" {
+				if state.Silent != true {
+					fmt.Printf("\n[-] Searching For Subdomains in Bing")
+				}
+				sourceConfig.Bing = true
 			} else if source == "ask" {
 				if state.Silent != true {
 					fmt.Printf("\n[-] Searching For Subdomains in Ask")
@@ -276,6 +284,8 @@ func PassiveDiscovery(state *helper.State) (finalPassiveSubdomains []string) {
 	if sourceConfig.Baidu == true {
 		go baidu.Query(state, ch)
 	}
+	if sourceConfig.Bing == true {
+		go bing.Query(state, ch)
 	if sourceConfig.Ask == true {
 		go ask.Query(state, ch)
 	}

libsubfinder/sources/bing/bing.go

@@ -0,0 +1,99 @@
+//
+// Written By : @Mzack9999 (Marco Rivoli)
+//
+// Distributed Under MIT License
+// Copyrights (C) 2018 Ice3man
+//
+
+// A golang client for Bing Subdomain Discovery
+package bing
+
+import (
+	"fmt"
+	"io/ioutil"
+	"regexp"
+	"strconv"
+	"sort"
+	"net/url"
+
+	"github.com/Ice3man543/subfinder/libsubfinder/helper"
+)
+
+// all subdomains found
+var subdomains []string
+
+// Query function returns all subdomains found using the service.
+func Query(state *helper.State, ch chan helper.Result) {
+
+	var result helper.Result
+	result.Subdomains = subdomains
+	min_iterations := 50
+	max_iterations := 760
+	search_query := ""
+	current_page := 0
+	for current_iteration := 0; current_iteration <= max_iterations; current_iteration++ {
+		new_search_query := "domain:" + state.Domain
+		if len(subdomains) > 0 {
+			new_search_query += " -www." + state.Domain
+		}
+		new_search_query = url.QueryEscape(new_search_query)
+		if search_query != new_search_query {
+			current_page = 0
+			search_query = new_search_query
+		}
+
+		resp, err := helper.GetHTTPResponse("https://www.bing.com/search?q=" + search_query + "&go=Submit&first=" + strconv.Itoa(current_page), state.Timeout)
+		if err != nil {
+			result.Error = err
+			ch <- result
+			return
+		}
+
+		// Get the response body
+		body, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			result.Error = err
+			ch <- result
+			return
+		}
+
+		// suppress all %xx sequences with a space
+		re_sub := regexp.MustCompile(`%.{2}`)
+		src := re_sub.ReplaceAllLiteralString(string(body), " ")
+
+		re := regexp.MustCompile(`([a-z0-9]+\.)+` + state.Domain)
+		match := re.FindAllString(src, -1)
+
+		new_subdomains_found := 0
+		for _, subdomain := range match {
+			if sort.StringsAreSorted(subdomains) == false {
+				sort.Strings(subdomains)
+			}
+			
+			insert_index := sort.SearchStrings(subdomains, subdomain)
+			if insert_index < len(subdomains) && subdomains[insert_index] == subdomain {
+				continue
+			}
+
+			if state.Verbose == true {
+				if state.Color == true {
+					fmt.Printf("\n[%sBing%s] %s", helper.Red, helper.Reset, subdomain)
+				} else {
+					fmt.Printf("\n[Bing] %s", subdomain)
+				}
+			}
+
+			subdomains = append(subdomains, subdomain)
+			new_subdomains_found++
+		}
+		// If no new subdomains are found exits after min_iterations
+		if new_subdomains_found == 0 && current_iteration > min_iterations {
+			break
+		}
+		current_page++
+	}
+
+	result.Subdomains = subdomains
+	result.Error = nil
+	ch <- result
+}