infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

merge yahoo_search_domain[ip] / bing_search_domain[ip]

bug/bundler_fix
join-us 2016-04-23 22:45:47 +08:00
parent 66c0832f27
commit d9633078ec
1 changed files with 22 additions and 95 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

117
modules/auxiliary/gather/searchengine_subdomains_collector.rb
View File

@ -46,9 +46,9 @@ class Metasploit4 < Msf::Auxiliary
80
end
def valid?(ip, domain)
ips = domain2ip(domain)
(ips && ips.include?(ip)) ? true : false
def valid_result?(target, subdomain)
data = Rex::Socket.is_ipv4?(target) ? domain2ip(subdomain) : subdomain
data && data.include?(target) ? true : false
end
def domain2ip(domain)
@ -132,107 +132,34 @@ class Metasploit4 < Msf::Auxiliary
results
end
def bing_search_domain(domain)
def search_subdomains(target)
domains = {}
subdomain_ips = []
dork = "domain:#{domain}"
results = bing_search(dork)
ipv4 = Rex::Socket.is_ipv4?(target)
dork = ipv4 ? "ip:#{target}" : "domain:#{target}"
results = [] # merge results to reduce query times
results |= bing_search(dork) if datastore['ENUM_BING']
results |= yahoo_search(dork) if datastore['ENUM_YAHOO']
return domains if results.nil? || results.empty?
results.each do |subdomain|
next if domains.include?(subdomain)
next unless subdomain.include?(domain)
ips = domain2ip(subdomain)
ips.each do |ip|
report_host(host: ip, name: subdomain)
print_good("#{dork} subdomain: #{subdomain} - #{ip}")
next if subdomain_ips.include?(ip)
subdomain_ips << ip if Rex::Socket.is_ipv4?(ip)
end
domains[subdomain] = ips
end
subdomain_ips.each do |ip|
bing_search_ip(ip) if datastore['IP_SEARCH']
end
return if domains.empty?
report_note(host: domain, type: 'Bing Search Subdomains', update: :unique_data, data: domains)
domains
end
def bing_search_ip(ip)
dork = "ip:#{ip}"
domains = {}
results = bing_search(dork)
return domains if results.nil? || results.empty?
results.each do |subdomain|
next if domains.include?(subdomain)
next unless valid?(ip, subdomain)
report_host(host: ip, name: subdomain)
print_good("#{dork} suddomain: #{subdomain}")
domains[subdomain] = ip
end
return if domains.empty?
report_note(host: ip, type: 'Bing Search Subdomains', update: :unique_data, data: domains)
domains
end
def yahoo_search_domain(domain)
domains = {}
subdomain_ips = []
dork = "domain:#{domain}"
results = yahoo_search(dork)
return domains if results.nil? || results.empty?
results.each do |subdomain|
next if domains.include?(subdomain)
next unless subdomain.include?(domain)
ips = domain2ip(subdomain)
ips.each do |ip|
report_host(host: ip, name: subdomain)
print_good("#{dork} subdomain: #{subdomain} - #{ip}")
next if subdomain_ips.include?(ip)
subdomain_ips << ip if Rex::Socket.is_ipv4?(ip)
end
domains[subdomain] = ips
end
subdomain_ips.each do |ip|
yahoo_search_ip(ip) if datastore['IP_SEARCH']
end
return if domains.empty?
report_note(host: domain, type: 'Yahoo Search Subdomains', update: :unique_data, data: domains)
domains
end
def yahoo_search_ip(ip)
dork = "ip:#{ip}"
domains = {}
results = yahoo_search(dork)
return domains if results.nil? || results.empty?
results.each do |subdomain|
next if domains.include?(subdomain)
next unless valid?(ip, subdomain)
report_host(host: ip, name: subdomain)
next unless valid_result?(target, subdomain)
print_good("#{dork} subdomain: #{subdomain}")
domains[subdomain] = ip
if ipv4
domains[subdomain] = [target]
else
ips = domain2ip(subdomain)
next if ips.empty?
domains[subdomain] = ips
ips.each { |ip| search_subdomains(ip) } if !ips.empty? && datastore['IP_SEARCH']
end
end
return if domains.empty?
report_note(host: ip, type: 'Yahoo Search Subdomains', update: :unique_data, data: domains)
domains
report_note(host: target, type: 'Subdomains', update: :unique_data, data: domains)
end
def run
target = datastore['TARGET']
if Rex::Socket.is_ipv4?(target)
bing_search_ip(target) if datastore['ENUM_BING']
yahoo_search_ip(target) if datastore['ENUM_YAHOO']
else
bing_search_domain(target) if datastore['ENUM_BING']
yahoo_search_domain(target) if datastore['ENUM_YAHOO']
end
search_subdomains(datastore['TARGET'])
end
end