0% found this document useful (0 votes)

128 views81 pages

Python Subdomain Scanner Tool Report

Q: How does the implementation of modules like CertSpotter and Hackertarget complement each other in the Python Based Recon Tool?

CertSpotter focuses on verifying SSL certificates, ensuring domain legitimacy, while Hackertarget specializes in enumerating subdomains through different methods. Their integration in the Python Based Recon Tool allows for comprehensive domain analysis by combining verification and discovery in a single streamlined process .

Q: How does combining multiple subdomain discovery techniques into the Python Based Recon Tool improve security assessments for ethical hackers?

By integrating multiple techniques, such as brute force, CertSpotter, and search engine querying, the Python Based Recon Tool allows ethical hackers to comprehensively assess a domain's security. This combinatory approach uncovers more potential vulnerabilities by leveraging diverse methodologies, enhancing the scope and accuracy of security assessments .

Q: How does the Python Based Recon Tool enhance the speed and efficiency of subdomain enumeration in penetration testing?

The Python Based Recon Tool integrates various techniques, such as brute force with improved wordlists, and querying search engines to speed up subdomain enumeration. It consolidates methods into a single tool, avoiding the need to switch between multiple tools, thus optimizing performance and reducing scan times .

Q: What role does the module Savemap play in the domain reconnaissance process, and why is it crucial for ethical hacking?

Savemap is critical for understanding the path a domain has taken, showing how many servers it has hopped through to reach its destination. This information is crucial for ethical hacking as it helps in identifying weak links in the network and understanding potential points of exploitation .

Q: What makes CertSpotter a preferable module for subdomain verification in ethical hacking compared to other open source Certificate Transparency monitors?

CertSpotter is considered more robust compared to other open source Certificate Transparency monitors due to its lack of database requirement, making it easier to use. It efficiently scans all browser-recognized Certificate Transparency logs and outputs a report without the need for complex setups .

Q: In what ways can the mechanisms used in the Python Based Subdomain Scanner be applied to other fields beyond cybersecurity?

The mechanisms for scanning and verifying domain information can be applied in fields like data collection and analysis, network administration, and information systems monitoring. These applications can benefit from the tool’s capacity for efficient data gathering and verification, facilitating better management and security of complex systems .

Q: Why is the verification of subdomains using SSL certificates important in the context of cybersecurity and ethical hacking?

Verifying subdomains with SSL certificates is essential as it helps ensure that the subdomains are legitimate and not compromised or fraudulent. This verification process adds an additional layer of security, reducing the risk of attacks or data breaches through unverified subdomains .

Q: How does a lightweight and simple infrastructure benefit the operation of the Python Based Recon Tool on Kali Linux?

A lightweight and simple infrastructure ensures that the Python Based Recon Tool operates efficiently on Kali Linux by minimizing resource consumption and preventing performance bottlenecks. This aspect is crucial for maintaining optimal speed and responsiveness during extensive reconnaissance operations .

Q: Discuss how the Python Based Recon Tool differs from existing tools like Amass and dnsrecon in terms of features and capabilities.

The Python Based Recon Tool distinguishes itself by consolidating techniques such as brute force, CertSpotter, and search engine querying into a single tool, unlike Amass and dnsrecon, which focus on individual techniques. This consolidation improves efficiency and reduces the complexity of the reconnaissance process .

Q: In what ways is the Python programming language particularly suited for developing a subdomain scanner in ethical hacking contexts?

Python is suited for developing a subdomain scanner due to its simple syntax, readability, and maintainability. These characteristics facilitate error-free coding and implementation, making it ideal for creating tools that need to be robust and adaptable in cybersecurity applications .

This document is a project report on developing a Python-based subdomain scanner tool. It was submitted by Keshav Kumar Ladda in partial fulfillment of a Master's degree in computer applications and information security management. The tool allows users to scan a target domain's DNS records to discover configured subdomains. It uses techniques like DNS queries, common subdomain names, wildcards, and other public data sources to identify subdomains in a reconnaissance process. The report includes sections on literature review, requirements analysis, system design, implementation, testing, and conclusions.

Uploaded by

harsh

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as DOCX, PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

128 views81 pages

Python Subdomain Scanner Tool Report

Uploaded by

harsh

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as DOCX, PDF, TXT or read online on Scribd

List of Figures
Contents
Introduction
Abstract
Literature Survey
Requirement Analysis
System Design
Implementation and Testing
Testing
Results and Discussions
Conclusions and Future Scope
Biodata of The Student
References

A Project Report

Python Based subdomain scanner Tool

Submitted

In partial fulfillment for the award of the degree

MASTER OF COMPUTER APPLICATIONS

INFORMATION SECURITY MANAGEMENT SERVICES

by
Keshav Kumar Ladda
18MCAR0007

Under the Guidance of

Ms Feon Jaison

Department of MCA
School of Computer Science & IT,
Jain Knowledge Campus, Jayanagar 9th Block, Bangalore

May 2021

JGI Knowledge Campus School of Computer Science & IT 2018-2019

CERTIFICATE

This is to certify that the project entitled PYTHON BASED

SUBDOMAIN SCANNER TOOL is the bonafide record of work done by
KESHAV KUMAR LADDA[18MCAR0007] of 6TH SEMESTER
MASTER OF COMPUTER PPLICATIONS INFORMATION SECURITY

MANAGEMENT SERVICES during the year 2020-2021. All the suggestions as

required have been incorporated by him/her in the current work. Further this work
or any part thereof has not been presented for the award Degree of any
University or Organization.

--------------------- ----------------------------------
Project Guide Head of the Department (MCA)

Head Department of (CS&IT)

-------------------------- -----------------------
Examiner-1 Examiner-2

Department of MCA
School of Computer Science & IT,
Jain Knowledge Campus, Jayanagar 9th Block, Bangalore

JGI Knowledge Campus School of Computer Science & IT 2018-2019

DECLARATION

I affirm that the Internship project work titled PYTHON BASED

SUBDOMAIN SCANNER TOOL being submitted in partial

fulfillment for the award of MASTER OF COMPUTER

APPLICATIONS INFORMATION SECURITY MANAGEMENT SERVICES

is the original work carried out by me. It has not formed the part of

any other project work submitted for award of any degree or diploma,

either in this or any other University.

(Signature of the Candidate)

Keshav Kumar Ladda

18MCAR0007

JGI Knowledge Campus School of Computer Science & IT 2018-2019

ACKNOWLEDGEMENT

I do acknowledge the support and encouragement of all people who helped me

throughout the completion of this project.

I would like to thank Dr. Dinesh Nilkhant, Director – JGI, Jayanagara 9 th

block campus, Dr. M N Nachappa , Dean of School of Computer Science & IT,
[Link] J, Program Coordinator, Dr. Lakshmi J V N and [Link] R,
Project Coordinators and all faculty members of MCA department for their
guidance and support.

I am highly indebted to my guide Prof. Ms Feon Jaison of Department of

MCA - School of Computer Science & IT for providing a valuable guidance
throughout the course of the project.

I am indebted to my Parents and Friends, whose constant support and blessings

gave a driving force to go on and to all my friends for their continued moral and
material support throughout the course of the project. I am grateful to the
Almighty for giving me strength and ability to complete the project successfully.

Keshav Kumar Ladda

18MCAR00
07

JGI Knowledge Campus School of Computer Science & IT 2018-2019

LIST OF FIGURES

Fig NO FIGURE NAME PAGE#

Fig 3.2 User Case descriptions…………………………………………….. 12
Fig 4.1 Context Diagram……………………………………….………….. 13
Fig 4.2 Proposed System Architecture …….……………………………. 13
Fig 4.2.1 ER Diagram ………………………………………………………. 14
Fig 4.3.1 Data flow Diagram………………………………………………… 15
Fig 4.3.2 Sequence Diagram………………………………………………… 16
Fig 7.1 Screenshots………………………………………………………… 55-69

JGI Knowledge Campus School of Computer Science & IT 2018-2019

ABSTRACT
A Recon is an important step in exploring an area to steal confidential information. It also plays a key role
in penetration testing. A proper recon would provide detailed information and open doors to attackers for
scanning and attacking all the way. By using a recon, an attacker can directly interact with potential open
ports, services running etc. or attempt to gain information without actively engaging with the [Link] can
provide all the critical information, which helps gain access to the networks beyond the internet. In short, a
recon is an endless treasure of information prone to attack. it is unknown how much time a recon can take to
ingress into networks, it may be days or months. Also, sometimes a recon cannot gain access to any
information system at all and at times, it can cause potential data breach, collecting all the sensitive data in
one go, exploiting networks.

Most entities neglect the recon at its early stage, where the true and precise information of the network and
their functions are lost. The purpose to perform a recon operation is to perform scanning and attacking in
much more precise and stealthy manner.
A hacker can have an opportunity to ingress into the network, through the systems that are unpatched and
outdated. They can stalk an employee physically or a breach might happen when a company has high
security measures by an outdated update policy.
A hacker might target on the following information and prepare a report on his recon work which includes
Subdomains,Whois Information,Dir info,S3 Buckets,Social accounts etc.
The above listing does not conclude the identities of recon, rather they are a few examples.

The proposed topic “PYTHON BASED SUBDOMAIN SCANNER TOOL” is a project. It is a tool made
with the help of PYTHON programming language. With this tool, user can gain knowledge of the target
websites. The Recon tool is a subdomain discovery tool. It allows you to run a scan for a top-level domain
name to discover target organization subdomains configured in its hierarchy. The Subdomain Scanner uses
the target domain’s DNS server (or any other DNS server specified) to scan the DNS records for possible
subdomains. While scanning, the Subdomain Scanner will also automatically identify if the domain being
scanned uses wildcards (*.[Link]).

It uses DNS servers and DNS enumeration based on common subdomain names. It uses brute-force method
to get subdomains and it does use SSL certificates, public search engines, certspotter, Virustotal and
mapping. subdomains of a domain is an essential part of hacking reconnaissance, having unsecured
subdomain can lead to a serious risk to your business, and lately, there were some security incidents where
the hacker used subdomains tricks.

JGI Knowledge Campus School of Computer Science & IT 2018-2019

CONTENTS

List of Figures I
Acronyms II
Abstract III
Chapter 1 Introduction 1
1.1 Background ………………………………………………… 1
1.2 Problem Definition ………………………………………. 2
1.3 Project Scope and Objectives …………………………….. 3
1.4 Organization of the Report ………………………………. 4
Chapter 2 Literature Survey 5
2.1 Survey of the Existing Work ……………………………… 5
2.2 Survey of Technologies …………………………………….. 6
Chapter 3 Requirements Analysis 9
3.1 Hardware and Software Requirements …………………. 9
3.2 Users and Use-case Descriptions …………………………. 9
3.3 Functional and Non-Functional Requirements …………. 11
Chapter 4 System Design 12
4.1 Context Diagram …………………………………………. 12
4.2 Proposed System Architecture and Data Design………… 12

4.2.1 ER Diagram ………………………………….. 13

4.3 Procedure Design 13

4.3.1 Data Flow Diagrams ………………………… 13
4.3.2 Sequence Diagram …………………………. 14

Chapter 5 Implementation and Testing 16

5.1 Implementatin Environment (Single/Multi user, GUI/non-GUI) 16
…………………………………………………………..

5.2 Module Description 16

5.1 Module 1 ……………………………………………. 16
5.2 Module 2 …………………………………………….. 16
5.3 Module 3…………………………………………….. 16
5.4 Module 4………………………………………….….. 16
5.5 Module 5…………………………………………….. 16
5.3 Coding………………………………………………….. 17

JGI Knowledge Campus School of Computer Science & IT 2018-2019

Chapter 6 Testing 52
6.1 Testin Approach……………………………………….. 52
6.2 Testing Plan……………………………………………. 52
6.3 Test Cases……………………………………………… 53
Chapter 7 Results and Discussions 54
7.1 Screenshots 54
7.1.1 Screenshot 1 ……………………………………. 54
7.1.2 Screenshot 2 ……………………………………. 54
7.1.3 Screenshot 3 …………………………………….. 55
7.1.4 Screenshot 4 …………………………………….. 55
7.1.5 Screenshot 5 …………………………………….. 56
7.1.6 Screenshot 6 …………………………………….. 56
7.1.7 Screenshot 7 …………………………………….. 57
7.1.8 Screenshot 8 …………………………………….. 57
7.1.9 Screenshot 9 …………………………………….. 58
7.1.10 Screenshot 10…………………………………….. 58
7.1.11 Screenshot 11…………………………………….. 59
7.1.12 Screenshot 12…………………………………….. 59
7.1.13 Screenshot 13…………………………………….. 60
7.1.14 Screenshot 14…………………………………….. 60
7.1.15 Screenshot 15…………………………………….. 61
7.1.16 Screenshot 16…………………………………….. 61
7.1.17 Screenshot 17…………………………………….. 61
7.1.18 Screenshot 18…………………………………….. 62
7.1.19 Screenshot 19…………………………………….. 62
7.1.20 Screenshot 20…………………………………….. 63
7.1.21 Screenshot 21…………………………………….. 63
7.1.22 Screenshot 22…………………………………….. 64
7.1.23 Screenshot 23…………………………………….. 64
7.1.24 Screenshot 24…………………………………….. 65
7.1.25 Screenshot 25…………………………………….. 65
7.1.26 Screenshot 26…………………………………….. 66
7.1.27 Screenshot 27…………………………………….. 66
7.1.28 Screenshot 28…………………………………….. 67
7.1.29 Screenshot 29…………………………………….. 67
7.1.30 Screenshot 30…………………………………….. 68
7.1.31 Screenshot 31…………………………………….. 68

7.2 Results and Observations 69

Chapter 8 Conclusions and Future Scope 70
8.1 Conclusions ………………………………………….. 70
8.2 Limitations …………………………………………… 70
8.3 Future Scope…………………………………………… 70

Biodata of The Student 71

References 72

JGI Knowledge Campus School of Computer Science & IT 2018-2019

JGI Knowledge Campus School of Computer Science & IT 2018-2019
PYTHON BASED SUBDOMAIN SCANNER TOOL Page 1

CHAPTER 1
INTRODUCTION
1.1 Background
⮚ The name of my project is “PHYTHON BASED RECON TOOL ”, the name itself tells us that it
is a tool used for gathering information of the target. Information such as finding vulnerable
subdomains which can led access to the main domain. Information Gathering and becoming more
acquainted to the target is the first process in ethical hacking. Information gathering is a key for
any successful hack. On average about three-fourth of any hack should be spent performing
precise and accurate reconnaissance.
⮚ The main reason for the development of this tool is to help ethical hackers to gather all the
necessary information of the target domains. Different tools are integrated into this project to find
verified subdomains fast. different tools like Bruteforce, Certspotter, Hackertarget, Virustotal,
Threatcrowd and SSL
⮚ Bruteforce:-Tools use brute force and recursive brute forcing techniques in order to generate
subdomain lists, most of the time combined with word-lists.
⮚ Certspotter:- CertSpotter is a Certificate Transparency log monitor from SSLMate that alerts
you when a SSL/TLS certificate is issued for one of your [Link] Spotter is easier than
other open source CT monitors, since it does not require a database. It's also more robust. Every
time you run Cert Spotter, it scans all browser-recognized. Certificate Transparency logs for
certificates matching domains on your watch list. When Cert Spotter detects a matching
certificate, it writes a report to standard out, which the Cron daemon emails to you. Make sure
you are able to receive emails sent by Cron.
⮚ Quering search engines:-Google hacking techniques are often used to find the subdomains of
any domain name.
⮚ Savemap:-The module lets us savemap of the domain like from where it originated how many
servers it has hopped. output can also be saved in a text file
⮚ The tool works only in kali linux and the requirements are simple for the tool to run
⮚ Features of the tool are it scans all the subdomains of the target domain and scans the subdomains
for verification using SSL,Certspotter and Bruteforce
⮚ It is a lightweight, easy to use, fast, extremely small size and handy Python commands .
⮚ This tool requires internet connection in order to transmit the significant Subdomains of the
target.
⮚ The mechanism used in this project could be used in various fields of operations in day to day
life.

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 2

⮚ During reconnaissance, an ethical hacker attempts to gather as much information about a target
system as possible such as −

● Gather initial information

● Determine the network range
● Identify active machines
● Discover open ports and access points
● Fingerprint the operating system
● Uncover services on ports
● Map the network

1.2 Problem Definition

There are various subdomains scanning recon tools which can be used to find the subdomains like
Amass, subBrute, knock, dnsrecon, Sublist3r etc. These tools use various different techniques like
querying search engines,performing brute force discovery fetching SSL/TLS public information the
problem comes when you have to use different tool for different techniques none e above tool
provide all techniques in one My project provides various different techniques like use of bruteforce
with improved and latest wordlist then verifying of subdomains using SSL verification and
Certspotter then querying of domain through search engines it also has mapping which helps in
finding out from how many servers the domain has hopped from and reached the destination. We
can also save the output in a document which later can be used to review.

Recon is a python tool designed to enumerate subdomains using modules. It helps penetration testers
and bug hunters collect and gather subdomains for the domain they are [Link] tool works only
in kali linux and the requirements are simple for the tool to run. Features of the tool are it scans all the
subdomains of the target domain and scans the subdomains for verification using SSL,Certspotter and
Bruteforce This tool requires internet connection in order to transmit the significant Subdomains of
the target, various tools have problem in scanning like taking excess time scanning and showing
results The mechanism used in this project could be used in various fields of operations in day to day
life.

1.3 Scope and Objective

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 3

The objective and scope of Project “PYTHON BASED SUBDOMAIN SCANNER TOOL” is to
gather subdomains of the target, which is very essential for Recon processes of ethical hacking. As
the first step of ethical hacking is reconassiace which is gathering information on the target then
filtering of the needed information to find vulnerabilities then perform attack. The project finds
subdomains as many organizations have vulnerable subdomains which can lead entry into the main
domain and leaking of previledged information. The main objective for the creation of the project is
as many do not provide fast collection of the subdomain from the target and filtering and verifying
of the [Link] project provides everything This tool code is written in PYTHON
programming language.

There are various modules in this project which help in achieiving the objective for which the tool is
built. The following modules are:-
⮚ Bruteforce:-Tools use brute force and recursive brute forcing techniques in order to generate
subdomain lists, most of the time combined with word-lists.
⮚ Certspotter:- CertSpotter is a Certificate Transparency log monitor from SSLMate that alerts
you when a SSL/TLS certificate is issued for one of your [Link] Spotter is easier than
other open source CT monitors, since it does not require a database. It's also more robust. Every
time you run Cert Spotter, it scans all browser-recognized. Certificate Transparency logs for
certificates matching domains on your watch list. When Cert Spotter detects a matching
certificate, it writes a report to standard out, which the Cron daemon emails to you. Make sure
you are able to receive emails sent by Cron.
⮚ Quering search engines:-Google hacking techniques are often used to find the subdomains of
any domain [Link] WhoIs lookup,visiting target domain etc.
⮚ Savemap:-The module lets us savemap of the domain like from where it originated how many
servers it has hopped.
⮚ Saving of output file:- after gathering of the information the information can be saved in an
output file
⮚ Verifying the subdomains with SSL certificates.

The scope of the project is that it can be used for reconassiance in ethical hackers, pentesters and security
professionals in a organization and find vulnerable subdomains.

1.4 ORGANIZATION OF THE REPORT

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 4

1. Outer Title Page

2. Inner Title Page
3. Certificate
4. Declaration by Student
5. Acknowledgement
6. Abstract
7. Table of Contents
8. List of Tables
9. List of Figures
10. Body of The Report

CHAPTER 2
LITERATURE SURVEY
JGI Knowledge Campus School of Computer Science & IT 2018-2019
PYTHON BASED SUBDOMAIN SCANNER TOOL Page 5

2.1 Survey of the Existing Work

To create this project we have surveyed through many review papers, used various tools, blogs and
books the 4 functions we needed to create an powerful subdomain scanner is :-
 Use of the programming language :- using a programming language that is easy to code ,
rectify errors easily and easy to implement. There are many programming languages which
can be used to bulid the tool one such language that is used to built this tool is python
programming language The simple syntax rules of the programming language further makes it

easier for you to keep the code base readable and application maintainable, Compatible with
Major Platforms and Systems, Simplify Complex Software Development.
 Filter and verify the subdomains :- when we collect a large number of subdomains there are
times when we will not be needing all the subdomains and we also need to verify if all the
subdomain are working or not this can be done with various modules like Certspotter
CertSpotter is a Certificate Transparency log monitor from SSLMate that alerts you when a
SSL/TLS certificate is issued for one of your domains. then we can also scan the subdomains
through fetching SSL/TLS certificates. Filtering of the subdomains can be done by using
Bruteforce which scans subdomains through a particular wordlist thus there are no
unneccesary subdomains scanned.
 Fast collecting of the subdomains :- This can be the one of the factors whenever a pentester
or ethical hacker uses the tool to scan subdomains. The fast collection is nothing but at what
rate the subdomains are scanned and results are presented. The of the quickly collection of
subdomains can be done with Bruteforce, recursive bruteforce and full bruteforcing if this
does not quickly collect then VirusTotal subdomain database can be used to collect then by
running a query against.
 Simple commands :- This is not an important factor, but still to build the user-friendly tool
which does not confuse the end-user having simple command to scan, stop, using different
modules can help and make the tool popular among the community.
 To save the output :- most of the tools do not provide the function of saving the output into a
file which do not help the pentesters or security professionals as the output is needed for
further review with keeping mind of this function we have implemented an option to save the
file in a .txt format

2.2 Survey of Technologies

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 6

To build a powerful recon tool we used all the existing technologies under the domain some of the
technologies are :-
1. AMASS
Written by Jeff Foley, Amass is one of our favorite tools when it comes to subdomain discovery. It’s
one of the most powerful terminal-based commands there is for gathering and accumulating large
amounts of subdomain data.
Amass uses a variety of subdomain mapping techniques including scrapping, recursive brute force,
reverse NDS sweeping, and machine learning to get the full list of subdomains. It also includes full
integration with the SecurityTrails API for faster passive subdomain reconnaissance.
Installing Amass is easy by using the precompiled packages, or by using snap on Kali Linux and
other popular Linux distros, simply by typing:
snap install amass
Once you get it running, you can start playing. Let’s see how you can use it to find subdomains

easily. A basic subdomain scanning can be performing by running:

amass -d [Link].
2. SubBrute
SubBrute is one of the fastest brute-forcing subdomain discovery tools we’ve ever tested. One of
its coolest features is the ability to conceal the origin of the subdomain scanning itself, by using
open resolvers as proxy to DNS rate-limits. It can also work as a DNS spider that recursively
crawls enumerated DNS records, making it a complete DNS terminal-based toolkit.
SubBrute’s syntax is simple, as you see below:
./[Link] [Link] -o [Link]
SubBrute supports filtering DNS records. For example, if you need to get only TXT records from
any given domain name, you can use the –type option:
./[Link] -s [Link] [Link] --type TXT
Another great thing about SubBrute is the fact that it can be integrated into your own python
scripts by using the [Link]() function. For example:
import subbrute
for d in [Link]("[Link]"):
print d
For advanced usage, simply run: ./subbrute -h

3. Knock

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 7

Knock is another Python subdomain scanner tool helping infosec researchers with the intel-gathering
process. It works by performing a full DNS zone transfer, and if that fails, it can run a query against
the VirusTotal subdomain database. It’s a simple program that does a great job when you need to
find subdomains. Its only dependency is the python-dnspython package that can be found on all
major Linux distributions. Once you have that sorted out, using it becomes a really simple task.

knockpy [Link]

For this test configured our VirusTotal API key within this file:

knockpy/[Link]

Then we ran the setup:

python [Link] install

Finally, we ran the scan against a target, for example:

knockpy [Link]

The same scan will also provide other useful details such as IP address, response status, domain
name and remote detected server hostname. You can also launch scans using external wordlists with
the -w option:

knockpy [Link] -w [Link]

Advanced scans and other options can be found by running knockpy -h

4. DNSRecon

DNSRecon is one of the most well-known domain reconnaissance scripts. As with almost every
other one on this list, it’s written in Python. It works by checking all NS records for AXFR zone
transfers, and can be very useful in DNS enumeration for almost any type of records, including
MX, SOA, NS, TXT, SPF and SRV. It also supports wildcard resolution checking andbrute force-
based discovery for A and AAAA type-records with wordlists. But its powers don’t end there—it
can also query Google dorks to fetch indexed subdomains by GoogleBot.

After downloading the DNSRecon package, you’ll need to install a few required packages with
pip:

pip install -r [Link]

Then you are ready to test it: :

./[Link] -d [Link]

While the simple -d option can help with your dns discovery, you can also find subdomains by
using a dictionary file with the -D option:

[root@securitytrails dnsrecon]# ./[Link] -d [Link] -D [Link]

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 8

[*] Performing General Enumeration of Domain: [Link]

5. Sublist3r
Sublist3r is another Python-based tool that can be used as a massive subdomain scanner. It’s
widely used by bug bounty hunters, as well as blue and red teams across the globe for subdomain data
collection.
By querying search engines such as Bing, Yahoo, Google, Baidu and other 3rd party sources like
Netcraft or VirusTotal subdomain database, it can be one of the most effective and fastest tools
around when you want to find subdomains. And if that’s not enough, you may be surprised to learn
that Sublist3r also supports brute-force attacks with wordlists. Sublist3r minimum requirements are
Python2 or Python3 versions. Python 2 recommended version: 2.7.x ,Python 3 recommended version:
3.4.x. To get started, you’ll need to clone the Git repo, then run the installation for some of the
dependencies with pip:
pip install -r [Link]
That’s it. Now you can perform subdomain scanning tasks:
./[Link] -d [Link]
This subdomain scanner also includes a cool feature that only scans subdomains that have certain
ports open. For example:
python [Link] -d [Link] -p 80,443
This request will perform a subdomain enumeration and filter only those hosts with 80 and 443 ports
open.
6. AltDNS
AltDNS is a subdomain discovery tool based on work with alterations and permutations.
By setting your own wordlist (or using the default wordlist at default altdns/[Link]) of possible
sensitive areas (let’s say dev, staging, test, server, etc.), as well as using a list of confirmed
subdomains, you can run the script to generate both altered or mutated results that may be present in
the domain name. It includes a dataset of 200+ subdomains that can be used to churn out valid
subdomains.
After cloning the git project, dependencies can be resolved quickly by using pip:
pip install -r [Link]
Then you are ready to start using AltDNS:
./[Link] -i [Link] -o data_output -w [Link] -r -s results_output.txt
Note: [Link] is the actual subdomain list you know already exists, and [Link] is
AltDNS’s own wordlist.

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 9

CHAPTER 3
REQUIREMENT ANALYSIS

3.1 Hardware and Software Requirements

HARDWARE REQUIREMENTS:

⮚ 2GB RAM
⮚ 2GB Required Storage Space

SOFTWARE REQUIREMENTS:

⮚ Project Recon Folder which consists of wordlists, python scripts

⮚ Kali Linux or any other linux operating system

3.2 Users and Use-case Descriptions

The users for this project are :-

 Pentesters :- Pentesters, also known as penetration testing users, is a securityassessment,

an analysis, and progression of simulated attacks on an application (web, mobile, or API)
or network to check its securityposture. So they use Recon tools to find weakness The
objective is to penetrate the application or networksecurity defenses by looking for
vulnerabilities. These are usuallyweaknesses or flaws that an attacker could exploit to
impact confidentiality, integrity, or availability. This goal is the same whetherperforming
application pentesting or network [Link] output of a pentest is a list of
vulnerabilities, the risks theypose to the application or network, and a concluding report
withan executive summary of the testing along with information on itsmethodology and
recommendations for [Link] vulnerabilities found during a penetration test can
be used tofine-tune your security policies, patch your applications ornetworks, identify
common weaknesses across applications, andin general strengthen your entire security
posture.

 Whitehat Hackers / Ethical Hackers :- White hat hackers choose to use their powers for
good rather than evil. Also known as “ethical hackers,” white hat hackers can sometimes
be paid employees or contractors working for companies as security specialists that
attempt to find security holes via [Link] is done through using Recon tools
White hat hackers employ the same methods of hacking as black hats, with one exception-
they do it with permission from the owner of the system first, which makes the process
completely legal. White hat hackers perform penetration testing, test in-place security
systems and perform vulnerability assessments for companies. There are even courses,
training, conferences and certifications for ethical hacking.

 Black Hat Hackers:- Like all hackers, black hat hackers usually have extensive
knowledge about breaking into computer networks and bypassing security protocols. They
are also responsible for writing malware, which is a method used to gain access to these
systems. Their primary motivation is usually for personal or financial gain, but they can
also be involved in cyber espionage, protest or perhaps are just addicted to the thrill of
cybercrime. Black hat hackers can range from amateurs getting their feet wet by spreading
malware, to experienced hackers that aim to steal data, specifically financial information,

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 10

personal information and login credentials. Not only do black hat hackers seek to steal
data, they also seek to modify or destroy data as well.

 script kiddie:- is someone who lacks programming knowledge and uses existing software
to launch an attack. Often a script kiddie will use these programs without even knowing
how they work or what they do. For example, imagine a child gets their first computer.
The child watches a movie about hacking and then downloads a copy of Kali Linux. They
begin playing with the various programs while searching for online tutorials. At first, they
may be perceived as nothing more than an internet troll or noob, due to their lack of
experience and quickness to brag and boast. Sometimes they will even resort to
cyberstalking or bullying. However , this may simply be a cover for other more nefarious
activity.

USE CASE DESCRIPTIONS

Use case 1:- open/start the tool

Open the [Link] file from the project folder in the linux terminal then go to help command which
gives brief description of the commands that can be used in the tool it also help with what commands
can be used to get the results.

Use case 2 :- execute commands

There are command for each and every module that should be used to execute the particular module.
Typing of the wrong command can cause error for the particular module. The error can force you to
restart the tool.

Use case 3 :- saving the output in the file

Once all module commands are executed they can be saved for further review the ouput of the file is
saved I [Link] format it is saved in the root directory from where it can be accessed and reviewed.

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 11

Fig 1 Use case Descriptions

3.3 Functional and Non-Functional Requirements

Functional Requirements
As the project is a command line based proper entering of the commands is required orelse no output will
be displayed instead error will be displayed even a upper/lower case letter difference can cause error. The
proper python file should be executed in order to start the tool, executing help command can help to know
all the commands that can be used in the tool. Python3 or higher should be pre installed on the linux
operating systems is necessary also need to install dnspython to do DNS query.
Non Functional reuqirements
The user is required to have updated kali with Python3 and Dnspython files on the system for using this
tool. Internet is necessary to retrieve information from target.

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 12

CHAPTER 4
SYSTEM DESIGN

4.1 Context Diagram

A context diagram, sometimes called a level 0 data-flow diagram, is drawn in order to define and
clarify the boundaries of the software system. It identifies the flows of information between the system
and external entities.
The level 0 data -flow diagram for the project is user gives command to the terminal in return
terminal gets the results from the server and returns it to the terminal.

Launches Recon tool Scans

Hackertarget API
End-User Domain Server
Display Collects and
Results Sends data

Fig 2 Context Diagram

4.2 Proposed System Architecture And Data Design

The system architecture for the project is nothing but the communication between System, tool
API and the Domain Server.

System Recon Tool launched

Fig 3 proposed System Architecture

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 13

4.2.1 ER Diagram

YES
User launches Displays Title and Enter command
space to type python3
PYTHON
[Link] –Help
BASED command
SUBDOMAIN

Hacker Traget
API

Results are
shown/Output

Fig 4 ER Diagram

4.3 Procedure Design

4.3.1 DATA FLOW DIAGRAM
This diagram explains how the request is made by the PYTHON BASED SUBDOMAIN
SCANNER TOOL to the API and how the API sends necessary information of the target to the
user.
User starts PYTHON BASED SUBDOMAIN SCANNER TOOL, gives command python3
[Link] –help will get list of commands that can be used for various modules once we execute a
command for particular module. The HackerTarget API takes the request and performs scan on
specified domain name. And displays the result back to the user in the tool.

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 14

Fig 5 level 2 Data Flow Diagram

4.3.2 SEQUENCE DIAGRAM

Sequence Diagram explains how user gets information of the target system through HackerTarget
CLI.
User opens PYTHON BASED SUBDOMAIN SCANNER TOOL, selects module of which he
wants information and inserts the domain or IP address of the target. The HackerTarget CLI takes
the request and performs scan on specified domain name or IP address. And displays the result
back to the user in the tool.

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 15

Fig 6 Sqeuence Diagram

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 16

CHAPTER 5
IMPLEMENTATION AND TESTING

5.1 Implementation Environment

The final and important phase of system life cycle is the installation of the tool. The term
installation has different meanings, ranging from the conversation of basic application a complete
replacement of a computer system. The procedure, however are virtually the same. Installation is
the process of converting system into an operational one. It involves user training and successful
running of the developed systems.
The project has the simple installation as it is command-line project there is non-GUI interface. It is
single user project, only single user can use it as commands are needed to be typed by single user.
The tool can run without installation but the project folder must be present in the system before
launching the tool. Tool is user friendly, the user needs only proper knowledge of commands to be
typed for particular modules. The tool can run on all linux systems. To run the tool no heavy
configuration is needed.

5.2 Module Description

There are various modules in this project which are used to built tool. The following modules
are:-
⮚ Bruteforce:-Tools use brute force and recursive brute forcing techniques in order to generate
subdomain lists, most of the time combined with word-lists.
⮚ Certspotter:- CertSpotter is a Certificate Transparency log monitor from SSLMate that alerts
you when a SSL/TLS certificate is issued for one of your [Link] Spotter is easier than
other open source CT monitors, since it does not require a database. It's also more robust. Every
time you run Cert Spotter, it scans all browser-recognized. Certificate Transparency logs for
certificates matching domains on your watch list. When Cert Spotter detects a matching
certificate, it writes a report to standard out, which the Cron daemon emails to you. Make sure
you are able to receive emails sent by Cron.
⮚ Quering search engines:-Google hacking techniques are often used to find the subdomains of
any domain [Link] WhoIs lookup,visiting target domain etc.
⮚ Savemap:-The module lets us savemap of the domain like from where it originated how many
servers it has hopped.
⮚ Saving of output file:- after gathering of the information the information can be saved in an
output file

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 17

⮚ Verifying the subdomains with SSL certificates.

5.3 Coding
[Link]
#!/usr/bin/python3

# Recon,
# Bug Bounty Recon, search for subdomains and save in to a file
# Coded By Keshav Ladda

# import go here :)

import argparse # parse arguments

import sys
import time
import urllib3

# Import internal functions

from functions import R, W, Y, G
from functions import mapping_domain

# Import internal modules

from modules import tuga_certspotter
from modules import tuga_crt
from modules import tuga_hackertarget
from modules import tuga_threatcrowd
from modules import tuga_virustotal
from modules import tuga_entrust
from modules import tuga_googlesearch

# Import BruteForce tugascan

from tugascan import TugaBruteScan
from [Link] import bscan_dns_queries
from [Link] import bscan_whois_look

# Banner, Tuga or portuguese, is the same ;)

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 18

def banner():
print(R + " \n"
" _____ \n"
" / __ \___ _________ ____ \n"
" / /_/ / _ \/ ___/ __ \/ __ \ \n"
" / _, _/ __/ /__/ /_/ / / / / \n"
" /_/ |_|\___/\___/\____/_/ /_/ V: 0.1 \n"
" \n"
"\n"
" # Coded By keshav #\n"
" " + W)
print(Y + "Recon, a recon tool to find subdomains\n" + W)

##############################################################################
##

# parser error
def parser_error(errmsg):
print("Usage: python3 " + [Link][0] + " [Options] use -h for help")
print("Error: " + errmsg)
[Link](1)

##############################################################################
##

# parse the arguments

def parse_args():
example_text = f'''\nmodules: certspotter, hackertarget, virustotal, threatcrowd, ssl,
googlesearch\n
Examples:
python3 {[Link][0]} -d [Link]
python3 {[Link][0]} -d [Link] --enum ssl
python3 {[Link][0]} -d [Link] --enum certspotter --savemap
python3 {[Link][0]} -d [Link] -o [Link]
python3 {[Link][0]} -d [Link] --savemap
python3 {[Link][0]} -d [Link] --bruteforce

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 19

python3 {[Link][0]} -d [Link] -b --full

'''
parser = [Link](epilog=example_text,
formatter_class=[Link])
[Link] = parser_error
parser._optionals.title = "OPTIONS"
parser.add_argument('-d', '--domain', type=str, help="Domain name to enumerate it's
subdomains", required=True)
# parser.add_argument('-p', '--ports', help='Scan the found subdomains against specified tcp
ports')
parser.add_argument('-s', '--savemap', help='Save subdomains image map', action='store_true')

parser.add_argument('-b', '--bruteforce', help='Enable the bruteforce scan', action='store_true')

parser.add_argument('-f', dest='file', default='first_names.txt',
help='A file contains new line delimited subs, default is first_names.txt.')
parser.add_argument('--full', dest='full_scan', default=False, action='store_true',
help='Full scan, NAMES FILE first_names_full.txt will be used to brute')
parser.add_argument('-i', '--ignore', dest='i', default=False, action='store_true',
help='Ignore domains pointed to private IPs')
parser.add_argument("-t", "--threads", help="Number of threads to use to scan the domain.
Default is 200",
default=200, type=int)
parser.add_argument('-o', '--output', help='Save the results to text file')
parser.add_argument('--enum', nargs='*', help='<Module required> Perform enumerations and
network mapping')
return parser.parse_args()

##############################################################################
##

# parse host from scheme, to use for certificate transparency abuse

def parse_url(url):
try:
host = [Link].parse_url(url).host
except Exception as e:
print('[*] Invalid domain, try again..')

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 20

[Link](1)
return host

##############################################################################
##

def queries(target):
print(G + "Enumerating subdomains for " + target + " \n" + W)
[Link](0.1)
print(R + "Searching in SSL Certificates in " + target + " " + W)
[Link](0.1)
print(R + "Searching in CertsPotter in " + target + " " + W)
[Link](0.1)
print(R + "Searching in Virustotal in " + target + " " + W)
[Link](0.1)
# print(R + "Searching in Entrust Datacard in " + target + " " + W)
# [Link](0.1)
print(R + "Searching in ThreatCrowd in " + target + " \n" + W)
[Link](1)

##############################################################################
##

def main(target, output, savemap, enum, threads, bruteforce, args):

# bruteforce fast scan
if bruteforce:
d = TugaBruteScan(target, options=args)
[Link]()
[Link]()
[Link]()
[Link]()

try:
# <Module required> Perform enumerations and network mapping

supported_engines = {'certspotter': tuga_certspotter.Certspotter,

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 21

'hackertarget': tuga_hackertarget.Hackertarget,
'virustotal': tuga_virustotal.Virustotal,
'threatcrowd': tuga_threatcrowd.Threatcrowd,
'ssl': tuga_crt.CRT,
# 'entrust': tuga_entrust.Entrust,
'googlesearch': tuga_googlesearch.GoogleSearch

}
chosenEnums = []

# Default modules
if enum is None:
queries(target)
chosenEnums = [tuga_certspotter.Certspotter, tuga_hackertarget.Hackertarget,
tuga_virustotal.Virustotal,
tuga_threatcrowd.Threatcrowd, tuga_crt.CRT]

# Start super fast enumeration

enums = [indicate(target, output) for indicate in chosenEnums]

else:
for engine in enum:
if [Link]() in supported_engines:
[Link](supported_engines[[Link]()])
# Start the enumeration
enums = [indicate(target, output) for indicate in chosenEnums]

# Save map domain (png file)

if savemap is not False:

mapping_domain(target)
except KeyboardInterrupt:
print("\nTugaRecon interrupted by user\n")
[Link]()
##############################################################################
##

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 22

def menu():
banner()
args = parse_args() # args = parser.parse_args()
target = parse_url([Link])
output = [Link]
# port = [Link]
savemap = [Link]
enum = [Link]
threads = [Link]
bruteforce = [Link]
bscan_dns_queries(target)
bscan_whois_look(target)

main(target, output, savemap, enum, threads, bruteforce, args)

if __name__ == "__main__":
menu()

[Link]
# Recon,
# Bug Bounty Recon, search for subdomains and save in to a file
# Coded By Keshav Ladda

# import go here

import os # Miscellaneous operating system interfaces

import queue # A synchronized queue class
import re # Regular expression operations
import sys # System-specific parameters and functions
import threading # Thread-based parallelism
import time # Time access and conversions

import [Link] # dnspython

from functions import G, W, R

# Import internal
from [Link] import is_intranet

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 23

from lib.console_terminal import getTerminalSize

#####################################################################################
#############

class TugaBruteScan:

def init(self, target, options):

[Link] = target
[Link] = options # default threads 200
self.ignore_intranet = options.i # need more options... not complete
# set threads and count system to 0
self.thread_count = self.scan_count = self.found_count = 0
[Link] = [Link]()
# Resize console
self.console_width = getTerminalSize()[0] - 2 # thanks guys
self.msg_queue = [Link]()
self.STOP_SCAN = False
[Link](target=self._print_msg).start()
self._load_dns_servers() # load DNS servers from a list
# set resolver from [Link]
[Link] = [[Link](configure=False) for _ in range([Link])]
for _ in [Link]:
_.lifetime = _.timeout = 6.0
self._load_next_sub()
[Link] = [Link]()
t = [Link](target=self._load_sub_names)
[Link]()
while not [Link]() > 0 and t.is_alive():
[Link](0.1)
# create a target folder and save results in to a file
if [Link]:
outfile = [Link]
if not [Link]("results/" + [Link]):
[Link]("results/" + [Link])

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 24

else:
#pass
outfile = 'results/' + [Link] + "/" + target + '_tugascan.txt' if not options.full_scan else 'results/'
+ [Link] + "/" + target + '_tugascan_full.txt'
#outfile = 'results/' + target + '_tugascan.txt' if not options.full_scan else 'results/' + target +
'_tugascan_full.txt'
[Link] = open(outfile, 'w')
# save ip ,dns.
self.ip_dict = {}
self.last_scanned = [Link]()
self.ex_resolver = [Link](configure=False)
self.start_time = None

#####################################################################################
##########

def _load_dns_servers(self):
# dns_servers.txt
print(G + '[+] Initializing, validate DNS servers ...')
self.dns_servers = []
with open('wordlist/dns_servers.txt') as f:
for line in f:
server = [Link]()
if not server:
continue
while True:
if [Link]() < 50:
t = [Link](target=self._test_dns_servers, args=(server,))
[Link]()
break
else:
[Link](0.1)

while [Link]() > 2:

[Link](0.1)
self.dns_count = len(self.dns_servers) # count the number of DNS servers

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 25

[Link]('\n')
print('[+] Found %s available DNS Servers' % self.dns_count)
if self.dns_count == 0:
print('[ERROR] Oops! No DNS Servers available.')
self.STOP_SCAN = True
[Link](-1)

#####################################################################################
##########

def _test_dns_servers(self, server):

resolver = [Link](configure=False)
[Link] = [Link] = 10.0
try:
[Link] = [server]
answers = [Link]('[Link]') # test lookup a existed domain
if answers[0].address != '[Link]':
raise Exception('incorrect DNS response')
try:
[Link]('[Link]') # Non-existed domain test
with open('wordlist/bad_dns_servers.txt', 'a') as f:
[Link](server + '\n')
self.msg_queue.put('[+] Bad DNS Server found %s' % server)
except:
self.dns_servers.append(server)
self.msg_queue.put('[+] Check DNS Server %s < OK > Found %s' % ([Link](16),
len(self.dns_servers)))
except:
self.msg_queue.put('[+] DNS Server %s <Fail> Found %s' % ([Link](16),
len(self.dns_servers)))

#####################################################################################
##########

def _load_sub_names(self):

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 26

self.msg_queue.put('[+] Load the first list name...')

self.msg_queue.put('[+] Prepare the wildcard...\n' + W)

# Verify the first wordlist

if [Link].full_scan and [Link] == 'first_names.txt':

_file = 'wordlist/first_names_full.txt'
else:
if [Link]([Link]):
_file = [Link]
elif [Link]('wordlist/%s' % [Link]):
_file = 'wordlist/%s' % [Link]

else:
self.msg_queue.put('[ERROR] Oops! Names file not exists: %s' % [Link])
return

# Wildcard --------------------------------------------------

normal_lines = []
wildcard_lines = []
wildcard_list = []
regex_list = []
lines = set()

with open(_file) as f:
for line in f:
sub = [Link]()
if not sub or sub in lines:
continue
[Link](sub)

if [Link]('{alphnum}') >= 0 or [Link]('{alpha}') >= 0 or [Link]('{num}') >= 0:

wildcard_lines.append(sub)
sub = [Link]('{alphnum}', '[a-z0-9]')
sub = [Link]('{alpha}', '[a-z]')

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 27

for item in normal_lines:

lst_subs.append(item)
if len(lst_subs) >= GROUP_SIZE:
[Link](lst_subs)
lst_subs = []

sub_queue = [Link]()
for line in wildcard_lines:
sub_queue.put(line)
while sub_queue.qsize() > 0:
item = sub_queue.get()
if [Link]('{alphnum}') >= 0:
for _letter in 'abcdefghijklmnopqrstuvwxyz0123456789':
sub_queue.put([Link]('{alphnum}', _letter, 1))
elif [Link]('{alpha}') >= 0:
for _letter in 'abcdefghijklmnopqrstuvwxyz':
sub_queue.put([Link]('{alpha}', _letter, 1))
elif [Link]('{num}') >= 0:
for _letter in '0123456789':
sub_queue.put([Link]('{num}', _letter, 1))

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 28

else:
lst_subs.append(item)
if len(lst_subs) >= GROUP_SIZE:
while [Link]() > 10000:
[Link](0.1)
[Link](lst_subs)
lst_subs = []

if lst_subs:
[Link](lst_subs)

#####################################################################################
##########

def _load_next_sub(self):
self.msg_queue.put('[+] Load second list name...')
next_subs = []

# Verify the first wordlist

_file = 'wordlist/next_names.txt' if not [Link].full_scan else 'wordlist/next_names_full.txt'

# Wildcard

with open(_file) as f:
for line in f:
sub = [Link]()
if sub and sub not in next_subs:
tmp_set = {sub}
while len(tmp_set) > 0:
item = tmp_set.pop()
if [Link]('{alphnum}') >= 0:
for _letter in 'abcdefghijklmnopqrstuvwxyz0123456789':
tmp_set.add([Link]('{alphnum}', _letter, 1))
elif [Link]('{alpha}') >= 0:
for _letter in 'abcdefghijklmnopqrstuvwxyz':

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 29

tmp_set.add([Link]('{alpha}', _letter, 1))

elif [Link]('{num}') >= 0:
for _letter in '0123456789':
tmp_set.add([Link]('{num}', _letter, 1))
elif item not in next_subs:
next_subs.append(item)
self.next_subs = next_subs
# print(self.next_subs) just for test

#####################################################################################
##########

def _update_scan_count(self):
self.last_scanned = [Link]()
self.scan_count += 1

#####################################################################################
##########

def _update_found_count(self):
# no need to use a lock
self.found_count += 1

#####################################################################################
##########

def _print_msg(self):
while not self.STOP_SCAN:
try:
_msg = self.msg_queue.get(timeout=0.1)
except:
continue

if _msg == 'status':
msg = 'Found %s subdomains | %s groups left | %s scanned in %.1f seconds| %s threads' % (
self.found_count, [Link](), self.scan_count, [Link]() - self.start_time,

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 30

self.thread_count)
[Link]('\r' + ' ' * (self.console_width - len(msg)) + msg)
elif _msg.startswith('[+] Check DNS Server'):
[Link]('\r' + _msg + ' ' * (self.console_width - len(_msg)))
else:
[Link]('\r' + _msg + ' ' * (self.console_width - len(_msg)) + '\n') # print subdomains in
# console
[Link]()

#####################################################################################
##########

def _scan(self):
thread_id = int([Link]().getName())
[Link][thread_id].nameservers = [self.dns_servers[thread_id % self.dns_count]]

_lst_subs = []
[Link]()
self.thread_count += 1
[Link]()

while not self.STOP_SCAN:

if not _lst_subs:
try:
_lst_subs = [Link](timeout=0.1)
except:
if [Link]() - self.last_scanned > 2.0:
break
else:
continue
sub = _lst_subs.pop()
# print("1: ",sub) just for tests
_sub = [Link]('.')[-1]
# print("2: ", _sub) just for tests
_sub_timeout_count = 0
while not self.STOP_SCAN:

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 31

try:
cur_sub_domain = sub + '.' + [Link]
self._update_scan_count()
self.msg_queue.put('status')
try:
answers = [Link][thread_id].query(cur_sub_domain)
except [Link] as e:
answers = self.ex_resolver.query(cur_sub_domain)
is_wildcard_record = False
if answers:
ips = ', '.join(sorted([[Link] for answer in answers]))
if ips in ['[Link]', '[Link]', '[Link]']:
break

if (_sub, ips) not in self.ip_dict:

self.ip_dict[(_sub, ips)] = 1
else:
self.ip_dict[(_sub, ips)] += 1

if ips not in self.ip_dict:

self.ip_dict[ips] = 1
else:
self.ip_dict[ips] += 1

if self.ip_dict[(_sub, ips)] > 3 or self.ip_dict[ips] > 6:

is_wildcard_record = True

if is_wildcard_record:
break

if (not self.ignore_intranet) or (not is_intranet(answers[0].address)):

self._update_found_count()
msg = cur_sub_domain.ljust(50) + ips # default [30, 50], msg = <subs>.<target> and
info.
self.msg_queue.put(msg)
self.msg_queue.put('status')

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 32

[Link](cur_sub_domain.ljust(50) + '\t' + ips + '\n')

[Link]()

try:
[Link][thread_id].query('lordneostark.' + cur_sub_domain)
except [Link] as e:
_lst = []
if_put_one = ([Link]() < self.dns_count * 5)
for i in self.next_subs:
_lst.append(i + '.' + sub)
if if_put_one:
[Link](_lst)
_lst = []
elif len(_lst) >= 10:
[Link](_lst)
_lst = []
if _lst:
[Link](_lst)
except:
pass
break
except ([Link], [Link]) as e:
break
except ([Link], [Link], [Link]) as e:
_sub_timeout_count += 1
if _sub_timeout_count >= 6: # give up
break
except Exception as e:
with open('[Link]', 'a') as errFile:
[Link]('%s [%s] %s %s\n' % (threading.current_thread, type(e), cur_sub_domain, e))
break
[Link]()
self.thread_count -= 1
[Link]()
self.msg_queue.put('status')

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 33

#####################################################################################
##########

def run(self):
self.start_time = [Link]()
for i in range([Link]):
try:
t = [Link](target=self._scan, name=str(i)) # pass to def _scan()
[Link](True)
[Link]()
except:
pass
while self.thread_count > 0:
try:
[Link](0.1) # time sleep 1, try to change to 0.1 or 0
except KeyboardInterrupt as e:
msg = (R + '[WARNING] User aborted, wait all slave threads to exit...' + W)
[Link]('\r' + msg + ' ' * (self.console_width - len(msg)) + '\n\r')
[Link]()
self.STOP_SCAN = True
self.STOP_SCAN = True

#####################################################################################
##########

[Link]
# Recon - funcions, write by Keshav Ladda
# Recon,
# Bug Bounty Recon, search for subdomains and save in to a file
# Coded By keshav ladda

import sys
import [Link]
import webbrowser
import [Link]
import urllib3

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 34

import os
from pathlib import Path

# Colors

global G, Y, B, R, W

G = '\033[92m' # green
Y = '\033[93m' # yellow
B = '\033[94m' # blue
R = '\033[91m' # red
W = '\033[0m' # white

# parse host from scheme, to use for certificate transparency abuse

def parse_url(url):
try:
host = [Link].parse_url(url).host
except Exception as e:
print('[*] Invalid domain, try again..')
[Link](1)
return host

'''
# write subdomains to a file
def write_file(subdomains, output_file, target):
# saving subdomains results to output file
if not [Link]("results/" + target):
[Link]("results/" + target)
else:
pass
with open("results/" + target + "/" + output_file, 'a') as fp:
[Link](subdomains + '\n')
[Link]()
#DeleteDuplicate(target, subdomains)

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 35

# outfile = open("results/" + target + "/merge_files.txt", "a+")

# infile = open("results/" + target + "/" + output_file, 'r')
'''

def write_file(subdomains, output_file, target):

# saving subdomains results to output file
if not [Link]("results/" + target):
[Link]("results/" + target)
else:
pass
try:
with open("results/" + target + "/" + "[Link]", 'a') as tmp:
[Link](subdomains + '\n')
[Link]()
except:
pass

def DeleteDuplicate(output_file, target):

content = open("results/" + target + "/" + "[Link]", 'r').readlines()

content_set = set(content)
cleandata = open("results/" + target + "/" + output_file, 'w')
for line in content_set:
[Link](line)
try:
[Link]("results/" + target + "/" + "[Link]")
except OSError:
pass

#DeleteDuplicate(target, subdomains)

def mapping_domain(target):
try:
try:
[Link](f"[Link] + ".png",

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 36

f"results/{target}/{target}.png")
except [Link] as e:
print("", [Link])
my_file = Path(f"results/{target}/{target}.png")
if my_file.is_file():
[Link](f"results/{target}/{target}.png")
else:
print(Y + "\nOops! The map file was not generated. Try again...\n" + W)
except PermissionError:
print("You dont have permission to save a file, use sudo su")

# Future implementation
def Convert(subdomains):
subdomains_list = list([Link](","))
return subdomains_list

[Link]
import [Link] # dnspython
import whois

# Import internal
from functions import G, W, R, Y

#################################################################################
##############

def bscan_dns_queries(target):
print(G + "\n[+] DNS queries...\n" + W)
print(G + "**************************************************************\n" + W)
try:
for qtype in 'A', 'AAAA', 'MX', 'NS', 'TXT', 'SOA', 'CERT', 'HINFO', 'MINFO', 'TLSA', 'SPF':
answer = [Link](target, qtype, raise_on_no_answer=False, lifetime=10)
if [Link] is not None:
print([Link], '\n')
else:

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 37

pass
except Exception as e:
pass
print(G + "**************************************************************\n" + W)

#################################################################################
##############

def bscan_whois_look(target):
#domain = [Link](target)
#print(domain.__dict__, "\n")
#print([Link], "\n")
#print("Domain expiration: ", domain.expiration_date, "\n")
#print(G + "**************************************************************\n" + W)
pass

#################################################################################
##############

def is_intranet(ip):
ret = [Link]('.')
if not len(ret) == 4:
return True
if ret[0] == '10':
return True
if ret[0] == '172' and 16 <= int(ret[1]) <= 32:
return True
if ret[0] == '192' and ret[1] == '168':
return True
return False

#################################################################################
##############

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 38

Console [Link]

#### getTerminalSize()

__all__ = ['getTerminalSize']

def getTerminalSize():

import platform

current_os = [Link]()

tuple_xy = None

if current_os == 'Linux' or current_os == 'Darwin' or current_os.startswith('CYGWIN'):

tuple_xy = _getTerminalSize_linux()

if tuple_xy is None:

print ("default")

tuple_xy = (80, 25) # default value

return tuple_xy

def _getTerminalSize_linux():

def ioctl_GWINSZ(fd):

try:

import fcntl, termios, struct, os

cr = [Link]('hh', [Link](fd, [Link], '1234'))

except:

return None

return cr

cr = ioctl_GWINSZ(0) or ioctl_GWINSZ(1) or ioctl_GWINSZ(2)

if not cr:

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 39

try:

fd = [Link]([Link](), os.O_RDONLY)

cr = ioctl_GWINSZ(fd)

[Link](fd)

except:

pass

if not cr:

try:

cr = (env['LINES'], env['COLUMNS'])

except:

return None

return int(cr[1]), int(cr[0])

if __name__ == "__main__":

sizex, sizey = getTerminalSize()

print('width =', sizex, 'height =', sizey)

[Link]

# Recon - certspotter, write by keshav ladda

# Recon,
# Bug Bounty Recon, search for subdomains and save in to a file
# Coded By keshav ladda

# import modules
import time
import requests

from modules import tuga_useragents #random user-agent

from functions import write_file
from functions import DeleteDuplicate
from functions import G, W

class Certspotter:

def init(self, target, output):

[Link] = target
[Link] = output

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 40

self.module_name = "CertSpotter"
[Link] = "certspotter"

print(G + f"CertSpotter: Enumerating subdomains now for {target} \n" + W)

[Link] = self.engine_url()
[Link]([Link], output, target)
if [Link] is not None:
DeleteDuplicate([Link] + '_' + [Link], target)

def engine_url(self):
try:
url = f'[Link]
domain={[Link]}&include_subdomains=true&expand=dns_names'
response = [Link](url, headers=tuga_useragents.useragent())
except [Link]:
pass
return response

def enumerate(self, response, output, target):

subdomains = []
subdomainscount = 0
start_time = [Link]()

try:

while subdomainscount < 100:

subdomains = [Link]()[subdomainscount]["dns_names"][0]
subdomainscount = subdomainscount + 1
print(f"[*] {subdomains}")

if [Link] is not None:

write_file(subdomains, [Link] + '_' + [Link], target)

if [Link]:
print(f"\nSaving result... {[Link] + '_' + [Link]}")

except:
pass

if not subdomains:
print(f"[x] No data found for {[Link]} using CertSpotter.")
else:
print(G + f"\n[**] TugaRecon is complete. CertSpotter: {subdomainscount} subdomains
have been found in %s seconds" % (
[Link]() - start_time) + W)

[Link]

# Recon - HackerTarget module, write by keshav ladda

# Recon,
# Bug Bounty Recon, search for subdomains and save in to a file
# Coded By keshav ladda

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 41

# import modules

import time
import requests

# Import internal
from modules import tuga_useragents
from functions import write_file
from functions import G, W
from functions import DeleteDuplicate

class Hackertarget:

def init(self, target, output):

[Link] = target
[Link] = output
self.module_name = "HackerTarget"
[Link] = "hackertarget"

print(G + f"HackerTarget: Enumerating subdomains now for {target} \n" + W)

[Link] = self.engine_url()
[Link]([Link], output, target)

#if [Link] is not None:

#DeleteDuplicate([Link] + '_' + [Link], target)

def engine_url(self):
url = f"[Link]
response = [Link](url, headers=tuga_useragents.useragent())
return response

def enumerate(self, response, output, target):

subdomains = []
subdomainscount = 0
sub = []
start_time = [Link]()

try:
while subdomainscount < 10000:

# Remove "," an IP from list

remove_ip = [Link](",", " ")
subdomains = remove_ip.split()

subdomainscount = subdomainscount + 2
print(f"[*] {subdomains[subdomainscount]}")

# Write to a file
if [Link] is not None:

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 42

write_file(subdomains[subdomainscount], [Link] + '_' + [Link], target)

if [Link]:
print(f"\nSaving result... {[Link] + '_' + [Link]}")

except IndexError:
pass

if not subdomains:
print(f"[x] No data found for {[Link]} using HackerTarget.")
else:
print(
G + f"\n[**] Recon is complete. HackerTarget: {int((subdomainscount / 2) - 1)}
subdomains have been found in %s seconds" % (
[Link]() - start_time) + W)

[Link]

# Recon,
# Bug Bounty Recon, search for subdomains and save in to a file
# Coded By keshav ladda

# import go here

import requests
import sys
import re
import time

from bs4 import BeautifulSoup

from [Link] import urlparse

from functions import G, W, R

from modules import tuga_useragents
from functions import write_file

class GoogleSearch:

def init(self, target, output):

[Link] = target
[Link] = output
self.module_name = "Google Search"
[Link] = "googlesearch"
[Link] = set()

print(G + f"Google: Enumerating subdomains now for {target} \n" + W)

[Link](target, output)

############################################################################
###################

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 43

def get_list(self, target, page_number):

url = f'[Link]
8&start={page_number}'
return url
###################################################################################
############

def get_url(self, g_clean, page_number):

if page_number > 30:
for x in range(len(g_clean)):
print(g_clean[x])
[Link](0.5)
if [Link] is not None:
write_file(g_clean[x], [Link] + '_' + [Link], [Link])
####################################################################################
###########
def captcha(self):
for x in range(len(g_clean)):
print(g_clean[x])
[Link](0.5)
print(G + "ALERT " + W + "Google systems have detected unusual traffic ")

############################################################################
###################

# defining the googleSearch function

def google(self, target, output):

# declaring list g_clean to store the fetched urls

g_clean = []
page_number = 20

while page_number < 90:

# exception handling code to make sure we don't run into errors

try:
gurl = self.get_list(target, page_number)
#print(gurl)

# fetching the response using get method in requests

html = [Link](gurl, headers=tuga_useragents.useragent())
[Link](5)

if page_number > 50:

[Link](10)

page_number = page_number + 10

# checking the response status to be success

if html.status_code == 429:
print(G + "Google systems have detected unusual traffic ", html )
print("CAPTCHA detected!!! Maybe try form another IP, or wait..." +W)
[Link](1)

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 44

if html.status_code == 200:
# parsing the fetched html in the response using lxml parser in beautiful soup
soup = BeautifulSoup([Link], 'lxml')

# finding all the 'a' tags, links, in the parsed html

a = soup.find_all('a')
# looping through the all found a tags for processing

for i in a:
# extracting the href attribute for the link to the search results
k = [Link]('href')
# exception handling code to prevent running into erros

try:
# search for the pattern of a url to prevent unneccessary attributes in the result
using re module
m = [Link]("(?P<url>https?://[^\s]+)", k)
# fetching only the url part in the array
n = [Link](0)
# splitting the url up to the parameters part to get only the necessary url
rul = [Link]('&')[0]
# print(rul)
# parsing the url to divide it into components using urlparse
result = urlparse(rul)
# print(result)
domain = '{[Link]}://{[Link]}/'.format(uri=result)
# checking if the fetched url not belongs to target if true skip the url
# print("teste============== ", domain)
if not ([Link](f"{[Link]}", domain)):
continue
# else add it to the result list
else:
# print("teste==============> ", domain)
url_a = [Link](r"https?://(www\.)?")
url1 = url_a.sub('', domain).strip().strip('/')
# print("==============> ", url1)
if url1 not in g_clean:
# print("teste: s ", url1)
g_clean.append(url1)
else:
continue
except:
continue
finally:
self.get_url(g_clean, page_number)
if [Link]:
print(f"\nSaving result... {[Link] + '_' + [Link]}")
print(G + "\n[**] TugaRecon is complete." + W)
print(G + "Please wait some time... before doing a new search with this module\n" + W)

[Link]

# Recon - threatcrowd, write by keshav ladda

# Recon,

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 45

# Bug Bounty Recon, search for subdomains and save in to a file

# Coded By keshav ladda
# import modules

import time
import requests

from modules import tuga_useragents

from functions import write_file
from functions import DeleteDuplicate
from functions import G, W

class Threatcrowd:

def init(self, target, output):

[Link] = target
[Link] = output
self.module_name = "Threat Crowd"
[Link] = "threatcrowd"

print(G + f"Threat Crowd: Enumerating subdomains now for {target} \n" + W)

[Link] = self.engine_url()
[Link]([Link], output, target)
if [Link] is not None:
DeleteDuplicate([Link] + '_' + [Link], target)

def engine_url(self):
try:
url = f'[Link]
response = [Link](url, headers=tuga_useragents.useragent())
except [Link]:
pass
return response

def enumerate(self, response, output, target):

subdomains = set()
subdomainscount = 0
start_time = [Link]()

try:
while subdomainscount < 500:
subdomains = [Link]()["subdomains"][subdomainscount]
subdomainscount = subdomainscount + 1
print(f"[*] {subdomains}")

if [Link] is not None:

write_file(subdomains, [Link] + '_' + [Link], target)

if [Link]:
print(f"\nSaving result... {[Link] + '_' + [Link]}")

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 46

except IndexError:
pass

print(G + f"\n[**] TugaRecon is complete. Threat Crowd: {subdomainscount} subdomains

have been found in %s seconds" % (
[Link]() - start_time) + W)

if not subdomains:
print(f"[x] No data found for {[Link]} using Threat Crowd.")

[Link]

# TugaRecon - virustotal, write by LordNeoStark

# TugaRecon, tribute to Portuguese explorers reminding glorious past of this country
# Bug Bounty Recon, search for subdomains and save in to a file
# Coded By LordNeoStark | [Link] | [Link]
# import modules

import time

import requests

from functions import G, W

from functions import write_file
from functions import DeleteDuplicate
from modules import tuga_useragents

class Virustotal:

def init(self, target, output):

[Link] = target
[Link] = output
self.module_name = "VirusTotal"
[Link] = "Virustotal"

print(G + f"VirusTotal: Enumerating subdomains now for {target} \n" + W)

[Link] = self.engine_url()
[Link]([Link], output, target)
if [Link] is not None:
DeleteDuplicate([Link] + '_' + [Link], target)

def engine_url(self):
try:
url = f'[Link]
response = [Link](url, headers=tuga_useragents.useragent())
except [Link]:
pass
return response

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 47

def enumerate(self, response, output, target):

subdomains = set()
subdomainscount = 0
start_time = [Link]()

try:
while subdomainscount < 40:
subdomains = [Link]()["data"][subdomainscount]["id"]

if not subdomains:
print(f"[x] Oops! No data found for {[Link]} using SSL Certificates.")
else:
pass

subdomainscount = subdomainscount + 1
print(f"[*] {subdomains}")

if [Link] is not None:

write_file(subdomains, [Link] + '_' + [Link], target)

if [Link]:
print(f"\nSaving result... {[Link] + '_' + [Link]}")

except IndexError:
pass

print(
G + f"\n[**] TugaRecon is complete. VirusTotal: {subdomainscount} subdomains have
been found in %s seconds" % (
[Link]() - start_time) + W)

if not subdomains:
print(f"[x] No data found for {[Link]} using VirusTotal.")

[Link]

# Recon,
# Bug Bounty Recon, search for subdomains and save in to a file
# Coded By keshav ladda

# import go here
import requests
import time
import re

from functions import G, W

from modules import tuga_useragents
from functions import write_file
from functions import DeleteDuplicate

class Entrust:

def init(self, target, output):

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 48

[Link] = target
[Link] = output
self.module_name = "Entrust Datacard"
[Link] = "entrust"
[Link] = 0

[Link].urllib3.disable_warnings()

print(G + f"Entrust Datacard: Enumerating subdomains now for {target} \n" + W)

[Link] = self.engine_url()
[Link] = [Link]([Link])
#print("[+]: Parsed %s domain(s) from list." % len([Link]))
[Link]([Link], [Link], [Link])
if [Link] is not None and [Link] != 0:
DeleteDuplicate([Link] + '_' + [Link], target)
else:
pass

def engine_url(self):
try:
url = f'[Link]
fields=subjectDN&domain={[Link]}&includeExpired=true&exactMatch=false&limit=5000'
response = [Link](url, headers=tuga_useragents.useragent(), verify = False)
except [Link]:
pass
return response

def enumerate(self, response):

domains = []
start_time = [Link]()

restring = [Link](r"cn\\u003d(.*?)(\"|,)", [Link])

match = [Link](restring, [Link])

if match:
for domain in match:
# The following line avoids adding wildcard domains, as they will not resolve.
if ((domain[0] not in domains) and not ([Link]("^\*\.", domain[0]))):
[Link](domain[0])
return domains

def printDomains(self, domains, target, output):

for domain in sorted(domains):
print(domain)
[Link] = [Link] + 1

if [Link] is not None:

write_file(domain, [Link] + '_' + [Link], target)

print(G + f"\n[**] TugaRecon is complete. Entrust Datacard: {[Link]} subdomains have

been found" +W)

if [Link]:

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 49

print(f"\nSaving result... {[Link] + '_' + [Link]}")

#####################################################################################
####################

[Link]

# Import internal functions

from functions import R, W, Y, G
from functions import mapping_domain

# Import internal modules

# Import BruteForce tugascan

from tugascan import TugaBruteScan
from [Link] import bscan_dns_queries
from [Link] import bscan_whois_look

class modules:
def __init__(self, target, enum):

[Link] = target
[Link] = enum

def module_choose(self, target ,enum, savemap):

try:

bscan_dns_queries([Link])
bscan_whois_look([Link])

# <Module required> Perform enumerations and network mapping

supported_engines = {'certspotter': tuga_certspotter.Certspotter,

'hackertarget': tuga_hackertarget.Hackertarget,
'virustotal': tuga_virustotal.Virustotal,
'threatcrowd': tuga_threatcrowd.Threatcrowd,
'ssl': tuga_crt.CRT,
'entrust': tuga_entrust.Entrust,
'googlesearch': tuga_googlesearch.GoogleSearch

}
chosenEnums = []

if enum is None:
queries(target)

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 50

chosenEnums = [tuga_certspotter.Certspotter, tuga_hackertarget.Hackertarget,

tuga_virustotal.Virustotal,
tuga_threatcrowd.Threatcrowd, tuga_crt.CRT, tuga_entrust.Entrust]

# Start super fast enumeration

enums = [indicate(target, output) for indicate in chosenEnums]

else:

for engine in enum:

if [Link]() in supported_engines:
[Link](supported_engines[[Link]()])
# Start the enumeration

enums = [indicate(target, output) for indicate in chosenEnums]

# Save map domain (png file)

if savemap is not False:

mapping_domain(target)
except KeyboardInterrupt:
print("\nTugaRecon interrupted by user\n")
[Link]()

[Link]

# TugaRecon - crt module, write by LordNeoStark

import time
import requests

from functions import G, W

from modules import tuga_useragents
from functions import write_file
from functions import DeleteDuplicate

class CRT:

def init(self, target, output):

[Link] = target
[Link] = output
self.module_name = "SSL Certificates"
[Link] = "crt"

print(G + f"SSL Certificates: Enumerating subdomains now for {target} \n" + W)

[Link] = self.engine_url()
[Link]([Link], output, target)
if [Link] is not None and [Link] != 0:

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 51

DeleteDuplicate([Link] + '_' + [Link], target)

else:
pass

def engine_url(self):
try:
url = f"[Link]
response = [Link](url, headers=tuga_useragents.useragent())
return response
except [Link]:
pass

def enumerate(self, response, output, target):

subdomains = set()
[Link] = 0
start_time = [Link]()

try:
while [Link] < 10000:
subdomains = [Link]()[[Link]]["name_value"]

if not subdomains:
print(f"[x] Oops! No data found for {[Link]} using SSL Certificates.")
else:
[Link] = [Link] + 1
if "@" in subdomains: # filter for emails
pass
else:
print(f"[*] {subdomains}")

if [Link] is not None:

write_file(subdomains, [Link] + '_' + [Link], target)
if [Link]:
print(f"\nSaving result... {[Link] + '_'+ [Link]}")
except IndexError:
pass

#if not subdomains:

#print(f"[x] Oops! No data found for {[Link]} using SSL Certificates.")
#else:
print(
G + f"\n[**] TugaRecon is complete. SSL Certificates: {[Link]}
subdomains have been found in %s seconds" % (
[Link]() - start_time) + W)

CHAPTER 6
TESTING

6.1 Testing Approach

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 52

Software testing is more than just error detections. Testing software is operating the software under
controlled conditions.

Important aspects of software testing are:

Verification: it is checking or testing of items including software, for performance and consistency
by evaluating the results against pre-specified requirements.

Error detection: testing should intentionally attempt to make things go wrong to determine when
things happen they shouldn’t or things don’t happen when they should.

Validation: Validation looks at the system corrections, that is the process of checking that what has
been specified is what the user actually wanted.

6.2 Testing Plan

1. Unit Testing
This type of testing is performed by developers before the setup is handed over to the testing team to
formally execute the test cases. Unit testing is performed by the respective developers on the
individual units of source code assigned areas. The developers use test data that is different from the
test data of the quality assurance team. The goal of unit testing is to isolate each part of the program
and show that individual parts are correct in terms of requirements and functionality.

2. Integration Testing
Integration testing is defined as the testing of combined parts of an application to determine if they
function correctly. Integration testing can be done in two ways: Bottom-up integration testing and
Top-down integration testing.

3. Validation Testing
Software testing is one element of a broader topic that is often referred to as verification and
validation. Verification refers to the set of activities that ensure that software correctly implements a
specific function. Validation refers to a different set of activities that ensure that has been built is
traceable to customer requirements. Verification and Validation encompasses a wide array of SQA
activities that include formal technical reviews, quality and configuration audits, performance
monitoring, stimulation, feasibility study, documentation review and installation testing.

4. Performance Testing
Performance testing is the process of determining the speed or effectiveness of a computer, network,
software program or device. This process can involve quantitative tests done in a lab, such as
measuring the response time or the number of MIPS (millions of instructions per second) at which a
system functions. Qualitative attributes such as reliability, scalability and interoperability may also be
evaluated. Performance testing can verify that a system meets the specifications claimed by its
manufacturer or vendor. The process can compare two or more devices or programs in terms of
parameters such as speed, data transfer rate, bandwidth, throughput, efficiency or reliability.

6.3 Test Cases

Test case 1:

Scenario: When user enters wrong commands as it is command line tool

Description: It restarts the tool.

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 53

Test case 2:

Scenario: When user keeps the input field blank

Description: It doesn’t return anything.

Test case 3:

Scenario: when user enters case sensitive commands

Description: Displays error

Test Case 4:

Scenario: when user wrong spellings in commands

Description: Displays error

CHAPTER 7
RESULTS AND DISCUSSIONS
7.1 Screenshots

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 54

7.1.1 Screenshot 1

7.1.2 Screenshot 2

7.1.3 Screenshot 3

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 55

7.1.4 Screenshot 4

7.1.5 Screenshot 5

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 56

7.1.6 Screenshot 6

7.1.7 Screenshot 7

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 57

7.1.8 Screenshot 8

7.1.9 Screenshot 9

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 58

7.1.10 Screenshot 10

7.1.11 Screenshot 11

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 59

7.1.12 Screenshot 12

7.1.13 Screenshot 13

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 60

7.1.14 Screenshot 14

7.1.15 Screenshot 15

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 61

7.1.16 Screenshot 16

7.1.17 Screenshot 17

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 62

7.1.18 Screenshot 18

7.1.19 Screenshot 19

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 63

7.1.20 Screenshot 20

7.1.21 Screenshot 21

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 64

7.1.22 Screenshot 22

7.1.23 Screenshot 23

7.1.24 Screenshot 24

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 65

7.1.25 Screenshot 25

7.1.26 Screenshot 26

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 66

7.1.27 Screenshot 27

7.1.28 Screenshot 28

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 67

7.1.29 Screenshot 29

7.1.30 Screenshot 30

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 68

7.1.31 Screenshot 31

7.2 Results and Observations

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 69

From this project/tool the observations are:-

 First the project folder is opened i.e [Link] and then select the [Link] file right click on the file
and select the option open with terminal the terminal is opened with recon folder.
 Next step is executing the command python3 [Link] –help this will give brief information on the
commands that can be used to enumerate the subdomains like –bruteforce, --certspotter, --savemap
and –output. There are example commands which can be used to get the gist of the the tool.
 Then next step is to start enumerating any domain, command is python3 [Link] -d [Link]
this will give the result of all the subdomains present in the Domain.
 Next step is to check the subdomains with SSL command is python3 [Link] -d [Link] –
enum ssl this gives the result of all the subdomains that have the SSL certificates.
 Next step is to get the scanned subdomains checked through the Certspotter and saving the map the
command is python3 [Link] -d [Link] –enum certspotter –savemap this gives the result of
all the subdomains that have passd through the certspotter. Saves the image of the map in the results
folder in the project folder.
 Next step is find all subdomains through bruteforceing it is nothing but to find all subdomains
specific to the wordlist the command is python3 [Link] -d [Link] --bruteforce this gives
result of all the subdomains that are matched from the wordlist.
 Next step is doing full bruteforce that is to scan the subdomains against two or three wordlist the
command is python3 [Link] -d [Link] -b –full this gives the result of all the subdomains
that are matching the wordlist.
 Next step is to save all the results that are collected through the execution of the commands the
command to save the result is python3 [Link] -d [Link] -o –[Link] this gives the result
of all the modules like certspotter, hackerstarget etc into a document i.e [Link].
above are all the obervations and their results that have been observed during the running and using of the
tool

CHAPTER 8
CONCLUSIONS AND FUTURE SCOPE

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 70

8.1 conclusion

From this project we can conclude that this program is very useful to ethical hacker, pentesters
as it provides more convenience than the manual work. It provides easy methods to retrieve
information for the users. It is much fast and more efficient as the various modules in the tool help to
provide the results. The program can be used per the requirement of the user as it is very easy to
understand.
To conclude, this project “PYTHON BASED SUBDOMAIN SCANNER TOOL” is developed using
PYTHON programming. This project helps users to gather information of the target Domain. It can
implement its functions easily and fast. It is a lightweight tool. Thus, this project entitled above
includes all the above-mentioned features and is confirmed that it is up to the specifications entitled
for the project.

Key features of this application

⮚ Scanning of the subdomains through SSL certificates.
⮚ Scanning of the subdomains through Certspotter.
⮚ Scanning of the subdomains through Bruteforce.
⮚ Scanning of the subdomains through Hackerstarget.
⮚ Scanning of the subdomains through Virustotal
⮚ Saving the map of the subdomains from where they have been retrieved.
⮚ Saving of the output into a text file for further review.

8.2 Limitations
As no project is perfect there are certains limitations of the project the following are the
limitations of the project:-
 The main disadvantage of the project is it is non GUI the project is command line which
sometimes can create problem for the users
 There will be needing of more modules to scan the subdomains like dns zone transfers etc
 Lack of features,Adding more features like ARP poisoning, Sinffing of the network etc that can
be useful for the project

8.3 Future Scope

The project has many areas for the upgradation the future scope for the project/tool is as
following:-
 To make the project in full fleged GUI which is very easy to use for the user as compared to
typing the commands
 Adding of more modules related to subdomain scanning like having ping method, dns zone
transfers etc.
 Will be adding other features like sniffing, scanning of ports etc to make more useful as the
recon tool

Biodata of the Student

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 71

Keshav Kumar Ladda

18MCAR0007
MCA 5th semester
Department Of MCA
Information Security Management System
Jain Deemed –to –be University
Bangalore(Karnataka)
Pincode - 560056

References

JGI Knowledge Campus School of Computer Science & IT 2018-2019

PYTHON BASED SUBDOMAIN SCANNER TOOL Page 72

[1]. [Link]

[2].[Link]

omain_Enumeration_and_Analysis

[3]. [Link]

[4].[Link]

[5]. [Link]

JGI Knowledge Campus School of Computer Science & IT 2018-2019

Common questions