forked from The-Art-of-Hacking/h4cker
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathquick_recon.py
139 lines (118 loc) · 4.84 KB
/
quick_recon.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
#!/usr/bin/env python3
# A script to perform a quick OSINT recon for a given domains
# This is an example and work in progress
import os , sys , time , requests , random
from googlesearch import search
from termcolor import colored, cprint
from http import cookiejar
from urllib.parse import urlparse
from plugins import pasting
Subdomains = []
def SubdomainFilter(URL):
Parsed = urlparse(URL); Scheme = Parsed.scheme; Host = Parsed.netloc; URL = Scheme + "://" + Host + "/"
if URL not in Subdomains:
print(URL); Subdomains.append(URL)
if os.path.exists("alpha.txt"):
print("")
Qupdate = requests.get('https://raw.githubusercontent.com/The-Art-of-Hacking/h4cker/osint/quick_recon/qrecon_update.txt') #Quantom
Qupdate.status_code
if Qupdate.status_code == 200:
print(colored ('Cheking Update...' ,'white'))
print(colored(Qupdate.text , 'green'))
time.sleep(3) #
elif Qupdate.status_code == 404:
print(colored ('Cheking Update...' ,'white'))
print(colored ('Update Available ' ,'red'))
print(colored ('See https://github.com/The-Art-of-Hacking/h4cker/tree/master/osint' ,'red'))
print(colored ('Resuming...' ,'red'))
print("")
time.sleep(3) #
f = open('alpha.txt', 'r')
alpha = f.read()
print(colored (alpha,'yellow'))
else:
print("")
print(colored ('Please Run the quick_recon Script in the Main Directory' ,'red'))
print(colored ('First: cd quick_recon ' ,'red'))
print(colored ('Then : python3 quick_recon.py' ,'red'))
print(colored ('Exiting...' ,'red'))
time.sleep(5)
exit()
banner1 = """
Quick OSINT Recon of a given domain
̿з=(◕_◕)=ε
"""
print (banner1)
#--------------------------------------------------------------------------------#
class BlockAll(cookiejar.CookiePolicy):
return_ok = set_ok = domain_return_ok = path_return_ok = lambda self, *args, **kwargs: False
netscape = True
rfc2965 = hide_cookie2 = False
TLD = ["com","com.tw","co.in"]
beta = random.choice(TLD)
s = requests.Session()
s.cookies.set_policy(BlockAll())
#--------------------------------------------------------------------------------#
key = input (colored('[+] Set Target (site.com) : ', 'white' ))#Key
file = open("quick_recon.config", "w")
file.write(key)
file.close()
#V2
#V2
print("")
print(colored ('[>] Looking For Subdomains...' ,'green'))
query = "site:" + key + " -www." + key #SubTech1
for gamma in search(query, tld=beta, num=30 , stop=60 , pause=2):
SubdomainFilter(URL=gamma)
query = "site:*." + key #SubTech2
for gamma in search(query, tld=beta, num=30 , stop=60 , pause=2):
SubdomainFilter(URL=gamma)
print("")
if os.path.exists(".google-cookie"):
os.remove(".google-cookie")
print(colored ('[>] Looking For Sub-Subdomains...' ,'green'))
query = "site:*.*." + key
for gamma in search(query, tld=beta, num=30 , stop=60 , pause=2):
SubdomainFilter(URL=gamma)
print("")
if os.path.exists(".google-cookie"):
os.remove(".google-cookie")
print(colored ('[>] Looking For Login/Signup Pages...' ,'green'))
query = "inurl:login site:" + key #LogTech1
for gamma in search(query, tld=beta, num=30 , stop=60 , pause=2):
print("" + gamma)
query = "site:" + key + " inurl:signup | inurl:register | intitle:Signup" #LogTech2
for gamma in search(query, tld=beta, num=30 , stop=60 , pause=2):
print("" + gamma)
print ("")
if os.path.exists(".google-cookie"):
os.remove(".google-cookie")
# Sleeping for 60s to Avoid Google Block
print(colored ('[!] 20s Sleep to avoid Google Block' ,'yellow'))
time.sleep(21) # ; )
print(colored ('[!] Switching Google TLDs...' ,'yellow'))
TLD = ["co.ma","dz","ru","ca"]
zolo = random.choice(TLD)
print("")
#ok
print(colored ('[>] Looking For Directory Listing...' ,'green')) #DirListing
query = "site:" + key + " intitle:index of"
for gamma in search(query, tld=zolo, num=10 , stop=60 , pause=2):
print("" + gamma)
print ("")
if os.path.exists(".google-cookie"):
os.remove(".google-cookie")
print(colored ('[>] Looking For Public Exposed Documents...' ,'green')) #Docs
query = "site:" + key + " ext:doc | ext:docx | ext:odt | ext:pdf | ext:rtf | ext:sxw | ext:psw | ext:ppt | ext:pptx | ext:pps | ext:csv"
for gamma in search(query, tld=zolo, num=30 , stop=60 , pause=2):
print("" + gamma)
print ("")
if os.path.exists(".google-cookie"):
os.remove(".google-cookie")
print(colored ('[>] Looking For WordPress Entries...' ,'green')) #WP
query = "site:" + key + " inurl:wp- | inurl:wp-content | inurl:plugins | inurl:uploads | inurl:themes | inurl:download"
for gamma in search(query, tld=zolo, num=30 , stop=60 , pause=2):
print("" + gamma)
print ("")
if os.path.exists(".google-cookie"):
os.remove(".google-cookie")