From bdeb262a10a1d6fb4852eb458a7f1ecdf50e8758 Mon Sep 17 00:00:00 2001 From: six2dez Date: Tue, 4 May 2021 00:11:28 +0200 Subject: [PATCH] purednsv2 install and usage update --- install.sh | 2 +- reconftw.sh | 34 +++++++++++++++++----------------- reconftw_axiom.sh | 5 +++-- 3 files changed, 21 insertions(+), 20 deletions(-) diff --git a/install.sh b/install.sh index 9a760c6a..21b22c1a 100755 --- a/install.sh +++ b/install.sh @@ -28,6 +28,7 @@ gotools["gospider"]="go get -u github.com/jaeles-project/gospider" gotools["crobat"]="go get -v github.com/cgboal/sonarsearch/crobat" gotools["crlfuzz"]="GO111MODULE=on go get -v github.com/dwisiswant0/crlfuzz/cmd/crlfuzz" gotools["dalfox"]="GO111MODULE=on go get -v github.com/hahwul/dalfox/v2" +gotools["puredns"]="GO111MODULE=on go get github.com/d3mondev/puredns/v2" declare -A repos repos["degoogle_hunter"]="six2dez/degoogle_hunter" @@ -52,7 +53,6 @@ repos["massdns"]="blechschmidt/massdns" repos["OpenRedireX"]="devanshbatham/OpenRedireX" repos["GitDorker"]="obheda12/GitDorker" repos["testssl"]="drwetter/testssl.sh" -repos["puredns"]="d3mondev/puredns" repos["ip2provider"]="oldrho/ip2provider" dir=${tools} diff --git a/reconftw.sh b/reconftw.sh index e1917b26..8d433f6f 100755 --- a/reconftw.sh +++ b/reconftw.sh @@ -63,7 +63,6 @@ function tools_installed(){ [ -f $tools/LinkFinder/linkfinder.py ] || { printf "${bred} [*] LinkFinder [NO]${reset}\n"; allinstalled=false;} [ -f $tools/GitDorker/GitDorker.py ] || { printf "${bred} [*] GitDorker [NO]${reset}\n"; allinstalled=false;} [ -f $tools/degoogle_hunter/degoogle_hunter.sh ] || { printf "${bred} [*] degoogle_hunter [NO]${reset}\n"; allinstalled=false;} - [ -f $tools/puredns/puredns ] || { printf "${bred} [*] puredns [NO]${reset}\n"; allinstalled=false;} [ -f $tools/getjswords.py ] || { printf "${bred} [*] getjswords [NO]${reset}\n"; allinstalled=false;} eval type -P arjun $DEBUG_STD || { printf "${bred} [*] Arjun [NO]${reset}\n"; allinstalled=false;} eval type -P dirdar $DEBUG_STD || { printf "${bred} [*] dirdar [NO]${reset}\n"; allinstalled=false;} @@ -100,6 +99,7 @@ function tools_installed(){ eval type -P jq $DEBUG_STD || { printf "${bred} [*] jq [NO]${reset}\n${reset}"; allinstalled=false;} eval type -P notify $DEBUG_STD || { printf "${bred} [*] notify [NO]${reset}\n${reset}"; allinstalled=false;} eval type -P dalfox $DEBUG_STD || { printf "${bred} [*] dalfox [NO]${reset}\n${reset}"; allinstalled=false;} + eval type -P puredns $DEBUG_STD || { printf "${bred} [*] puredns [NO]${reset}\n${reset}"; allinstalled=false;} if [ "${allinstalled}" = true ] ; then printf "${bgreen} Good! All installed! ${reset}\n\n" @@ -376,7 +376,7 @@ function sub_active(){ fi cat .tmp/*_subs.txt | anew -q .tmp/subs_no_resolved.txt deleteOutScoped $outOfScope_file .tmp/subs_no_resolved.txt - eval $tools/puredns/puredns resolve .tmp/subs_no_resolved.txt -w .tmp/subdomains_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/subs_no_resolved.txt -w .tmp/subdomains_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD echo $domain | eval dnsx -retry 3 -silent -r $resolvers_trusted $DEBUG_ERROR | anew -q .tmp/subdomains_tmp.txt NUMOFLINES=$(eval cat .tmp/subdomains_tmp.txt $DEBUG_ERROR | grep "\.$domain$\|^$domain$" | anew subdomains/subdomains.txt | wc -l) end_subfunc "${NUMOFLINES} new subs (active resolution)" ${FUNCNAME[0]} @@ -391,7 +391,7 @@ function sub_dns(){ start_subfunc "Running : DNS Subdomain Enumeration" eval dnsx -retry 3 -a -aaaa -cname -ns -ptr -mx -soa -resp -silent -l subdomains/subdomains.txt -o subdomains/subdomains_cname.txt -r $resolvers_trusted $DEBUG_STD cat subdomains/subdomains_cname.txt | cut -d '[' -f2 | sed 's/.$//' | grep ".$domain$" | anew -q .tmp/subdomains_dns.txt - eval $tools/puredns/puredns resolve .tmp/subdomains_dns.txt -w .tmp/subdomains_dns_resolved.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/subdomains_dns.txt -w .tmp/subdomains_dns_resolved.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD NUMOFLINES=$(eval cat .tmp/subdomains_dns_resolved.txt $DEBUG_ERROR | grep "\.$domain$\|^$domain$" | anew subdomains/subdomains.txt | wc -l) end_subfunc "${NUMOFLINES} new subs (dns resolution)" ${FUNCNAME[0]} else @@ -404,9 +404,9 @@ function sub_brute(){ then start_subfunc "Running : Bruteforce Subdomain Enumeration" if [ "$DEEP" = true ] ; then - eval $tools/puredns/puredns bruteforce $subs_wordlist_big $domain -w .tmp/subs_brute.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns bruteforce $subs_wordlist_big $domain -w .tmp/subs_brute.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD else - eval $tools/puredns/puredns bruteforce $subs_wordlist $domain -w .tmp/subs_brute.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns bruteforce $subs_wordlist $domain -w .tmp/subs_brute.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD fi NUMOFLINES=$(eval cat .tmp/subs_brute.txt $DEBUG_ERROR | sed "s/*.//" | grep ".$domain$" | anew subdomains/subdomains.txt | wc -l) end_subfunc "${NUMOFLINES} new subs (bruteforce)" ${FUNCNAME[0]} @@ -434,7 +434,7 @@ function sub_scraping(){ fi sed -i '/^.\{2048\}./d' .tmp/gospider.txt cat .tmp/gospider.txt | egrep -o 'https?://[^ ]+' | sed 's/]$//' | unfurl --unique domains | grep ".$domain$" | anew -q .tmp/scrap_subs.txt - eval $tools/puredns/puredns resolve .tmp/scrap_subs.txt -w .tmp/scrap_subs_resolved.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/scrap_subs.txt -w .tmp/scrap_subs_resolved.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD NUMOFLINES=$(eval cat .tmp/scrap_subs_resolved.txt $DEBUG_ERROR | grep "\.$domain$\|^$domain$" | anew subdomains/subdomains.txt | tee .tmp/diff_scrap.txt | wc -l) cat .tmp/diff_scrap.txt | httpx -follow-host-redirects -random-agent -status-code -threads $HTTPX_THREADS -timeout 15 -silent -retries 2 -no-color | cut -d ' ' -f1 | grep ".$domain$" | anew -q .tmp/probed_tmp_scrap.txt end_subfunc "${NUMOFLINES} new subs (code scraping)" ${FUNCNAME[0]} @@ -453,41 +453,41 @@ function sub_permut(){ start_subfunc "Running : Permutations Subdomain Enumeration" if [ "$DEEP" = true ] ; then eval DNScewl --tL subdomains/subdomains.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl1.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl1.txt -w .tmp/permute1_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl1.txt -w .tmp/permute1_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute1_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute1.txt eval DNScewl --tL .tmp/permute1.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl2.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl2.txt -w .tmp/permute2_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl2.txt -w .tmp/permute2_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute2_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute2.txt eval cat .tmp/permute1.txt .tmp/permute2.txt $DEBUG_ERROR | anew -q .tmp/permute_subs.txt else if [[ $(cat .tmp/subs_no_resolved.txt | wc -l) -le 100 ]] then eval DNScewl --tL .tmp/subs_no_resolved.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl1.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl1.txt -w .tmp/permute1_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl1.txt -w .tmp/permute1_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute1_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute1.txt eval DNScewl --tL .tmp/permute1.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl2.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl2.txt -w .tmp/permute2_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl2.txt -w .tmp/permute2_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute2_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute2.txt eval cat .tmp/permute1.txt .tmp/permute2.txt $DEBUG_ERROR | anew -q .tmp/permute_subs.txt elif [[ $(cat .tmp/subs_no_resolved.txt | wc -l) -le 200 ]] then eval DNScewl --tL .tmp/subs_no_resolved.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl1.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl1.txt -w .tmp/permute_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl1.txt -w .tmp/permute_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute_subs.txt else if [[ $(cat subdomains/subdomains.txt | wc -l) -le 100 ]] then eval DNScewl --tL subdomains/subdomains.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl1.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl1.txt -w .tmp/permute1_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl1.txt -w .tmp/permute1_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute1_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute1.txt eval DNScewl --tL .tmp/permute1.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl2.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl2.txt -w .tmp/permute2_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl2.txt -w .tmp/permute2_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute2_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute2.txt eval cat .tmp/permute1.txt .tmp/permute2.txt $DEBUG_ERROR | anew -q .tmp/permute_subs.txt elif [[ $(cat subdomains/subdomains.txt | wc -l) -le 200 ]] then eval DNScewl --tL subdomains/subdomains.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl1.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl1.txt -w .tmp/permute_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl1.txt -w .tmp/permute_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute_subs.txt else printf "\n${bred} Skipping Permutations: Too Much Subdomains${reset}\n\n" @@ -521,13 +521,13 @@ function sub_recursive(){ for sub in $(cat subdomains/subdomains.txt); do sed "s/$/.$sub/" $subs_wordlist >> .tmp/brute_recursive_wordlist.txt done - eval $tools/puredns/puredns resolve .tmp/brute_recursive_wordlist.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT -w .tmp/brute_recursive_result.txt $DEBUG_STD + eval puredns resolve .tmp/brute_recursive_wordlist.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT -w .tmp/brute_recursive_result.txt $DEBUG_STD cat .tmp/brute_recursive_result.txt | anew -q .tmp/brute_recursive.txt eval DNScewl --tL .tmp/brute_recursive.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl1_recursive.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl1_recursive.txt -w .tmp/permute1_recursive_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl1_recursive.txt -w .tmp/permute1_recursive_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute1_recursive_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute1_recursive.txt eval DNScewl --tL .tmp/permute1_recursive.txt -p $tools/permutations_list.txt --level=0 --subs --no-color $DEBUG_ERROR | tail -n +14 | grep ".$domain$" > .tmp/DNScewl2_recursive.txt - eval $tools/puredns/puredns resolve .tmp/DNScewl2_recursive.txt -w .tmp/permute2_recursive_tmp.txt -r $resolvers -rt $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT -lt $PUREDNS_TRUSTED_LIMIT $DEBUG_STD + eval puredns resolve .tmp/DNScewl2_recursive.txt -w .tmp/permute2_recursive_tmp.txt -r $resolvers --resolvers-trusted $resolvers_trusted -l $PUREDNS_PUBLIC_LIMIT --rate-limit-trusted $PUREDNS_TRUSTED_LIMIT $DEBUG_STD eval cat .tmp/permute1_recursive.txt .tmp/permute2_recursive_tmp.txt $DEBUG_ERROR | anew -q .tmp/permute_recursive.txt NUMOFLINES=$(eval cat .tmp/permute_recursive.txt .tmp/brute_recursive.txt $DEBUG_ERROR | grep "\.$domain$\|^$domain$" | anew subdomains/subdomains.txt | wc -l) diff --git a/reconftw_axiom.sh b/reconftw_axiom.sh index 166b9d52..ba39c53d 100755 --- a/reconftw_axiom.sh +++ b/reconftw_axiom.sh @@ -63,7 +63,6 @@ function tools_installed(){ [ -f $tools/LinkFinder/linkfinder.py ] || { printf "${bred} [*] LinkFinder [NO]${reset}\n"; allinstalled=false;} [ -f $tools/GitDorker/GitDorker.py ] || { printf "${bred} [*] GitDorker [NO]${reset}\n"; allinstalled=false;} [ -f $tools/degoogle_hunter/degoogle_hunter.sh ] || { printf "${bred} [*] degoogle_hunter [NO]${reset}\n"; allinstalled=false;} - [ -f $tools/puredns/puredns ] || { printf "${bred} [*] puredns [NO]${reset}\n"; allinstalled=false;} [ -f $tools/getjswords.py ] || { printf "${bred} [*] getjswords [NO]${reset}\n"; allinstalled=false;} eval type -P arjun $DEBUG_STD || { printf "${bred} [*] Arjun [NO]${reset}\n"; allinstalled=false;} eval type -P dirdar $DEBUG_STD || { printf "${bred} [*] dirdar [NO]${reset}\n"; allinstalled=false;} @@ -100,6 +99,7 @@ function tools_installed(){ eval type -P jq $DEBUG_STD || { printf "${bred} [*] jq [NO]${reset}\n${reset}"; allinstalled=false;} eval type -P notify $DEBUG_STD || { printf "${bred} [*] notify [NO]${reset}\n${reset}"; allinstalled=false;} eval type -P dalfox $DEBUG_STD || { printf "${bred} [*] dalfox [NO]${reset}\n${reset}"; allinstalled=false;} + eval type -P puredns $DEBUG_STD || { printf "${bred} [*] puredns [NO]${reset}\n${reset}"; allinstalled=false;} eval type -P axiom-ls $DEBUG_STD || { printf "${bred} [*] axiom [NO]${reset}\n${reset}"; allinstalled=false;} if [ "${allinstalled}" = true ] ; then @@ -644,7 +644,7 @@ function webprobe_full(){ if ([ ! -f "$called_fn_dir/.${FUNCNAME[0]}" ] || [ "$DIFF" = true ]) && [ "$WEBPROBEFULL" = true ] then start_func "Http probing non standard ports" - eval axiom-scan subdomains/subdomains.txt -m nmapx -p $UNCOMMON_PORTS_WEB --max-retries 2 -Pn -o .tmp/nmap_uncommonweb.txt $DEBUG_STD && uncommon_ports_checked=$(cat .tmp/nmap_uncommonweb.txt | egrep -v "^#|Status: Up" | cut -d' ' -f4- | sed -n -e 's/Ignored.*//p' | tr ',' '\n' | sed -e 's/^[ \t]*//' | sort -u | grep "open" | cut -d '/' -f1 | sed -e 'H;${x;s/\n/,/g;s/^,//;p;};d') + eval axiom-scan subdomains/subdomains.txt -m naabu -p $UNCOMMON_PORTS_WEB -o .tmp/nmap_uncommonweb.txt $DEBUG_STD && uncommon_ports_checked=$(cat .tmp/nmap_uncommonweb.txt | cut -d ':' -f2 | sort -u | sed -e 'H;${x;s/\n/,/g;s/^,//;p;};d') if [ -n "$uncommon_ports_checked" ] then eval axiom-scan subdomains/subdomains.txt -m httpx -ports $uncommon_ports_checked -follow-host-redirects -random-agent -status-code -threads $HTTPX_UNCOMMONPORTS_THREADS -timeout 10 -silent -retries 2 -no-color -o .tmp/probed_uncommon_ports_tmp_.txt $DEBUG_STD && cat .tmp/probed_uncommon_ports_tmp_.txt | cut -d ' ' -f1 | grep ".$domain$" | anew -q .tmp/probed_uncommon_ports_tmp.txt @@ -824,6 +824,7 @@ function fuzz(){ sub_out=$(echo $sub | sed -e 's|^[^/]*//||' -e 's|/.*$||') ffuf -mc all -fc 404 -ac -t $FFUF_THREADS -sf -s -H "${HEADER}" -w $fuzz_wordlist -maxtime 900 -u $sub/FUZZ -or -o $dir/fuzzing/${sub_out}.tmp &>/dev/null eval cat $dir/fuzzing/${sub_out}.tmp $DEBUG_ERROR | jq '[.results[]|{status: .status, length: .length, url: .url}]' | grep -oP "status\":\s(\d{3})|length\":\s(\d{1,7})|url\":\s\"(http[s]?:\/\/.*?)\"" | paste -d' ' - - - | awk '{print $2" "$4" "$6}' | sed 's/\"//g' | sort |anew -q $dir/fuzzing/${sub_out}.txt + ## FFuf csv parsing ---- file.csv | cut -d ',' -f2,5,6 | tr ',' ' ' | awk '{ print $2 " " $3 " " $1}' | tail -n +2 | sort -k1 eval rm $dir/fuzzing/${sub_out}.tmp $DEBUG_ERROR done end_func "Results are saved in fuzzing/*subdomain*.txt" ${FUNCNAME[0]}