.
675 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # V1D0m
2 | Enumerate subdomains through Virustotal
3 |
4 |
5 | python v1d0m.py -h
6 |
7 | usage: v1d0m.py [-h] [-e EXPORT] -d DOMAIN
8 |
9 | This script obtains subdomains throught VirusTotal
10 |
11 | optional arguments:
12 | -h, --help show this help message and exit
13 | -e EXPORT, --export EXPORT
14 | Export the results to a json file (Y/N)
15 | Format available:
16 | 1.json
17 | 2.xlsx
18 | -d DOMAIN, --domain DOMAIN
19 | The domain to search subdomains
20 |
21 |
--------------------------------------------------------------------------------
/old_v1d0m.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | import requests
3 | from requests.packages.urllib3.exceptions import InsecureRequestWarning
4 | requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
5 | #Disable warning by SSL certificate
6 | import ssl
7 | ssl._create_default_https_context = ssl._create_unverified_context
8 | from urlparse import urlparse
9 | from bs4 import BeautifulSoup
10 | import argparse
11 | from argparse import RawTextHelpFormatter
12 | import xlsxwriter
13 | import json
14 | import sys
15 | import socket
16 |
17 | def banner():
18 | print """
19 | ...-' |`. _______
20 | .----. .----.| | | \ ___ `'. __ __ ___
21 | \ \ / / .... | | ' |--.\ \ | |/ `.' `.
22 | ' '. /' / -| | | | | \ ' .-''` ''-. | .-. .-. '
23 | | |' / | | | | | | ' .' '. | | | | | |
24 | | || | ...' `--' | | | | / ` | | | | | |
25 | '. `' .' | |`.| | ' .'' '| | | | | |
26 | \ / ` --------\ || |___.' /' | .-. || | | | | |
27 | \ / `---------'/_______.'/ . | | .|__| |__| |__|
28 | '----' \_______|/ . '._.' /
29 | '._ .'
30 | '-....-'`
31 | """
32 | print "\n"
33 | print """** Tool to obtain subdomains throught Virustotal's search
34 | ** Author: Ignacio Brihuega Rodriguez a.k.a N4xh4ck5
35 | ** DISCLAMER This tool was developed for educational goals.
36 | ** The author is not responsible for using to others goals.
37 | ** A high power, carries a high responsibility!
38 | ** Version 1.0"""
39 |
40 | def help():
41 | print """ \nThis script obtains subdomains throught Virustotal's search
42 |
43 | Example of usage: python v1d0m.py -d apple.es """
44 |
45 | def WhoIP(domain):
46 | print domain
47 | ip=""
48 | try:
49 | ip = socket.gethostbyname(domain)
50 | except Exception as e:
51 | print e
52 | print "It can't obtain the reverse IP"
53 | ip = "0.0.0.0"
54 | return ip
55 |
56 | def ExportResults(domain,ip,export):
57 |
58 | print "\n"
59 | row = 0
60 | col = 0
61 | if export == "js":
62 | #Export the results in json format
63 | print "Exporting the results in an json"
64 | with open ('output.json','w') as f:
65 | json.dump(ip,f)
66 | elif (export == "xl"):
67 | #Export the results in excel format
68 | print "\nExporting the results in an excel"
69 | # Create a workbook and add a worksheet.
70 | workbook = xlsxwriter.Workbook('output.xlsx')
71 | worksheet = workbook.add_worksheet()
72 | worksheet.write(row, col, "Domain")
73 | worksheet.write(row, col+1, "IP")
74 | row +=1
75 | for dom in domain:
76 | col = 0
77 | worksheet.write(row, col, dom)
78 | row += 1
79 | #update row
80 | row = 1
81 | for direction_ip in ip:
82 | col = 1
83 | worksheet.write(row, col, direction_ip)
84 | row += 1
85 | #close the excel
86 | workbook.close()
87 |
88 | def VisuResults(subdomain,export):
89 | array_ip=[]
90 | ip =""
91 | for i in subdomain:
92 | print "subdomains: "
93 | ip = WhoIP(i)
94 | array_ip.append(ip)
95 | print "\n\t- " + i+ " ["+ip+"]"
96 | ExportResults(subdomain,array_ip,export)
97 |
98 | def parser_html(response):
99 | subdomains =[]
100 | i = 0
101 | soup = BeautifulSoup(response.text, 'html.parser')
102 | for link_div in soup.findAll('div',{'id':'observed-subdomains'}):
103 | try:
104 | for link in link_div.findAll('a',href=True):
105 | try:
106 | if (urlparse(link.get('href'))!='' and urlparse(link.get('href')).path.strip()!=''):
107 | subdomains.append(urlparse(link.get('href')).path.split("domain/")[1].replace("/information/", ""))
108 | except Exception as e:
109 | print e
110 | pass
111 |
112 | except Exception as e:
113 | print e
114 | pass
115 | return subdomains
116 | def SendRequest(target,export):
117 | url ="https://www.virustotal.com/es/domain/"+target+"/information/"
118 | response = ""
119 | subdomains = []
120 | try:
121 | #Requests
122 | #Timeout to verify if the resource is available and verify to ignore SSL certificate
123 | response=requests.get(url,allow_redirects=True, timeout=10,verify=False)
124 | except requests.exceptions.RequestException as e:
125 | print "\nError connection to server!",response.url,
126 | pass
127 | except requests.exceptions.ConnectTimeout as e:
128 | print "\nError Timeout"
129 | pass
130 | subdomains = parser_html(response)
131 | VisuResults(subdomains,export)
132 |
133 | def main (argv):
134 | parser = argparse.ArgumentParser(description='This script obtains subdomains throught VirusTotal', formatter_class=RawTextHelpFormatter)
135 | parser.add_argument('-e','--export', help="Export the results to a json file (Y/N)\n Format available:\n\t1.json\n\t2.xlsx", required=False)
136 | parser.add_argument('-d','--domain', help="The domain to search subdomains",required=True)
137 | args = parser.parse_args()
138 | banner()
139 | help()
140 | target = args.domain
141 | output=args.export
142 | export = ""
143 | if output is None:
144 | export='N'
145 | if ((output == 'y') or (output == 'Y')):
146 | print "Select the output format:"
147 | print "\n\t(js).json"
148 | print "\n\t(xl).xlsx"
149 | export = raw_input()
150 | if ((export != "js") and (export != "xl")):
151 | print "Incorrect output format selected."
152 | exit(1)
153 | SendRequest(target,export)
154 |
155 | if __name__ == "__main__":
156 | main(sys.argv[1:])
157 |
--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
1 | #Module dependencies (installable via pip):
2 | beautifulsoup4==4.5.1
3 | requests==2.10.0
4 | argparse==1.4.0
5 | json
6 | xlsxwriter
7 |
--------------------------------------------------------------------------------
/v1d0m.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python3
2 | # -*- coding: utf-8 -*-
3 | """
4 | This script will return the subdomains of a main domain using the funcionality of virustotal
5 | """
6 | import requests
7 | from requests.packages.urllib3.exceptions import InsecureRequestWarning
8 | requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
9 | #Disable warning by SSL certificate
10 | import ssl
11 | ssl._create_default_https_context = ssl._create_unverified_context
12 | import urllib.parse
13 | from bs4 import BeautifulSoup
14 | import argparse
15 | from argparse import RawTextHelpFormatter
16 | import xlsxwriter
17 | import sys
18 | import json
19 | import socket
20 |
21 | def banner():
22 | print ("""
23 | ...-' |`. _______
24 | .----. .----.| | | \ ___ `'. __ __ ___
25 | \ \ / / .... | | ' |--.\ \ | |/ `.' `.
26 | ' '. /' / -| | | | | \ ' .-''` ''-. | .-. .-. '
27 | | |' / | | | | | | ' .' '. | | | | | |
28 | | || | ...' `--' | | | | / ` | | | | | |
29 | '. `' .' | |`.| | ' .'' '| | | | | |
30 | \ / ` --------\ || |___.' /' | .-. || | | | | |
31 | \ / `---------'/_______.'/ . | | .|__| |__| |__|
32 | '----' \_______|/ . '._.' /
33 | '._ .'
34 | '-....-'`
35 | """)
36 | print ("""
37 | ** Tool to obtain subdomains throught Virustotal's search
38 | ** Author: Ignacio Brihuega Rodriguez a.k.a N4xh4ck5
39 | ** DISCLAMER This tool was developed for educational goals.
40 | ** The author is not responsible for using to others goals.
41 | ** A high power, carries a high responsibility!
42 | ** Version 2.0""")
43 |
44 | def help():
45 | print (""" \nThis script obtains subdomains throught Virustotal's search
46 |
47 | Example of usage: python v1d0m.py -d apple.es """)
48 |
49 | def WhoIP(domain):
50 | """
51 | Function to obtain the IP of the domain - Reverse IP
52 | """
53 | try:
54 |
55 | print (domain)
56 | ip=""
57 | try:
58 | ip = socket.gethostbyname(domain)
59 | except:
60 | print ("It can't obtain the reverse IP")
61 | ip = "0.0.0.0"
62 | except Exception as e:
63 | print ("Error in function WhoIP" + str(e))
64 | finally:
65 | return ip
66 |
67 | def ExportResults(domain,ip,export):
68 | """
69 | This function exports the results in xlsx format
70 | """
71 | row = 0
72 | col = 0
73 | try:
74 | print ("\n")
75 | if export == "js":
76 | #Export the results in json format
77 | print ("Exporting the results in an json")
78 | with open ('output.json','w') as f:
79 | json.dump(domain,f)
80 | elif (export == "xl"):
81 | #Export the results in excel format
82 | print ("\nExporting the results in an excel")
83 | # Create a workbook and add a worksheet.
84 | workbook = xlsxwriter.Workbook('output.xlsx')
85 | worksheet = workbook.add_worksheet()
86 | worksheet.write(row, col, "Domain")
87 | worksheet.write(row, col+1, "IP")
88 | row +=1
89 | for dom in domain:
90 | col = 0
91 | worksheet.write(row, col, dom)
92 | row += 1
93 | #update row
94 | row = 1
95 | for direction_ip in ip:
96 | col = 1
97 | worksheet.write(row, col, direction_ip)
98 | row += 1
99 | #close the excel
100 | workbook.close()
101 | except Exception as e:
102 | print ("Error in function ExportResults" + str(e))
103 |
104 | def VisuResults(subdomain,export):
105 | """
106 | This function shows the subdomains on the screen
107 | """
108 | array_ip=[]
109 | ip =""
110 | try:
111 | for i in subdomain:
112 | print ("subdomains: ")
113 | ip = WhoIP(i)
114 | array_ip.append(ip)
115 | print ("\n\t- " + i+ " ["+ip+"]")
116 | except Exception as e:
117 | print ("Error in function VisuResults" + str(e))
118 | finally:
119 | ExportResults(subdomain,array_ip,export)
120 |
121 | def parser_html(data):
122 | """
123 | This function parsers the response and obtain the domain
124 | """
125 | subdomains =[]
126 | k = None
127 | try:
128 | for subdomain in data['data']:
129 | k = subdomain['id']
130 | subdomains.append(str(k))
131 | except Exception as e:
132 | print ("Error in function parser_html" + str(e))
133 | finally:
134 | """print (subdomains)
135 | exit(1)"""
136 | return subdomains
137 | def SendRequest(target,export):
138 | """
139 | This function sends the HTTP GET request
140 | """
141 | limit = 40 # the max lenght to look for without API
142 | url = "https://www.virustotal.com/ui/domains/{0}/subdomains?limit={1}".format(target, limit)
143 | response = ""
144 | subdomains = []
145 | try:
146 | try:
147 | #Requests
148 | #Timeout to verify if the resource is available and verify to ignore SSL certificate
149 | response=requests.get(url,allow_redirects=True, timeout=15,verify=False)
150 | except requests.exceptions.RequestException as e:
151 | print ("\nError connection to server!",response.url)
152 | pass
153 | except requests.exceptions.ConnectTimeout as e:
154 | print ("\nError Timeout")
155 | pass
156 | except Exception as e:
157 | print ("Error in function send_request" + str(e))
158 | finally:
159 | subdomains = parser_html(response.json())
160 | VisuResults(subdomains,export)
161 |
162 | def main (argv):
163 | """
164 | Main function of this tool
165 | """
166 | parser = argparse.ArgumentParser(description='This script obtains subdomains throught VirusTotal', formatter_class=RawTextHelpFormatter)
167 | parser.add_argument('-e','--export', help="Export the results to a json file (Y/N)\n Format available:\n\t1.json\n\t2.xlsx", required=False)
168 | parser.add_argument('-d','--domain', help="The domain to search subdomains",required=True)
169 | args = parser.parse_args()
170 | banner()
171 | help()
172 | target = args.domain
173 | output=args.export
174 | export = ""
175 | if output is None:
176 | export='N'
177 | if ((output == 'y') or (output == 'Y')):
178 | print ("Select the output format:")
179 | print ("\n\t(js).json")
180 | print ("\n\t(xl).xlsx")
181 | export = input()
182 | if ((export != "js") and (export != "xl")):
183 | print ("Incorrect output format selected.")
184 | exit(1)
185 | SendRequest(target,export)
186 |
187 | if __name__ == "__main__":
188 | main(sys.argv[1:])
189 |
--------------------------------------------------------------------------------