Skip to content

Commit f4c80b9

Browse files
EvolvingSysadminEvolvingSysadmin
committed
docs and programs added
1 parent 763eab0 commit f4c80b9

13 files changed

+11565
-1
lines changed

‎README.md

+10-1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,11 @@
11
# Domain-Enumeration
2-
This repository contains Python tools for domain enumeration.
2+
This repository contains instructions on the use of Python tools for Domain Enumeration.
3+
4+
## Topics
5+
- [Domain Enumeration Background](./docs/Domain-Enumeration-Background.md)
6+
- [Get Domain Registration Information](./docs/Get-Domain-Registration-Information.md)
7+
- [Get Subdomain Information](./docs/Get-Subdomain-Information.md)
8+
- [Get Port Information](./docs/Get-Port-Information.md)
9+
- [Get HTTP Links](./docs/Get-HTTP-Links.md)
10+
11+
## Licensing

‎docs/Domain-Enumeration-Background.md

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Domain Enumeration Background
2+
3+
This page describes domain enumeration, the advantages of using Python for domain enumeration, and the use cases for Python domain enumeration.
4+
5+
## Topics
6+
-
7+
- [What is Domain Enumeration?](#what-is-domain-enumeration)
8+
- [Why use Python for Domain Enumeration?](#why-use-python-for-domain-enumeration)
9+
- [Who should use Python for Domain Enumeration](#who-should-use-python-for-doamain-enumeration)
10+
11+
## What is Domain Enumeration?
12+
13+
## Why use Python for Domain Enumeration?
14+
15+
## Who should use Python for Doamain Enumeration?
16+

‎docs/Get-Domain-Registration-Information.md

+143
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# Get Domain Name Information
2+
3+
This page describes how to obtain domain information by using the WHOIS Python library.
4+
5+
## Topics
6+
7+
- [Background](#background)
8+
- [Use Case](#use-case)
9+
- [Prerequisites](#prerequisites)
10+
- [Usage](#usage)
11+
- [Validate Domain Name](#validate-domain-name)
12+
- [Get Domain Registrar](#get-domain-registrar)
13+
- [Get Domain Creation Date](#get-domain-creation-date)
14+
- [Get Domain Expiration Date](#get-domain-expiration-date)
15+
- [Get Domain Registration Email](#get-domain-registration-email)
16+
- [Get Domain Registration Location](#get-domain-registration-location)
17+
- [Get All Domain Registration Information](#get-all-domain-registration-information)
18+
- [Resources](#resources)
19+
20+
## Background
21+
22+
WHOIS is an Internet protocol for retrieving a record of domain name registration information. The [Python WHOIS package](https://pypi.org/project/python-whois/) uses Python to query and parse domain registration information. The registration information that can be obtained using the WHOIS Python library includes whether the domain is registered, the domain registrar, domain creation date, domain expiration date, and address of the domain owner.
23+
24+
## Use Case
25+
26+
The Python WHOIS package should be used when there is a need to obtain information about a domain name. The Python WHOIS package functions can be run individually to obtain specific domain name information or can be included within a larger Python program.
27+
28+
## Prerequisites
29+
30+
The Python WHOIS package must be installed to utilize the domain name lookup functions. The [latest version of Python 3](https://www.python.org/downloads/) is required to run the Python WHOIS package. The PIP3 Python package manager is required to install the Python WHOIS package. PIP3 is included with the latest version of Python 3.
31+
32+
Use PIP3 to Install the Python WHOIS package by running the following in a terminal:
33+
```
34+
pip3 install python-whois
35+
```
36+
37+
Use an import statement to install the Python WHOIS package at the beginning of the Python code:
38+
```
39+
import whois
40+
```
41+
42+
## Usage
43+
44+
Use the code below to complete each task using the WHOIS Python package. The information may not be filed with the domain registrar if a validated domain does not return the requested information.
45+
46+
### Validate Domain Name
47+
48+
Create the `check_registration` function using the Python WHOIS package to determine if a domain name is registered:
49+
```
50+
def check_registration(domain_name):
51+
try:
52+
w = whois.whois(domain_name)
53+
except Exception:
54+
return False
55+
else:
56+
return bool(w.domain_name)
57+
```
58+
59+
Use the `check_registration` function to validate registration of a list of domains by using an if else statement:
60+
```
61+
domains = [
62+
"amazon.com",
63+
"github.com",
64+
"notadomain.com",
65+
"thisisntregistered.net"
66+
]
67+
68+
for domain in domains:
69+
print(domain, "is registered" if check_registration(domain) else "is not registered")
70+
```
71+
72+
### Get Domain Registrar
73+
74+
Use the `check_registration` function to return the domain name registrar:
75+
76+
```
77+
domain_name = "github.com"
78+
if check_registration(domain_name):
79+
whois_info = whois.whois(domain_name)
80+
print("Domain registrar:", whois_info.registrar)
81+
```
82+
83+
### Get Domain Creation Date
84+
85+
Use the `check_registration` function to return the domain name creation date:
86+
```
87+
domain_name = "github.com"
88+
if check_registration(domain_name):
89+
whois_info = whois.whois(domain_name)
90+
print("Domain creation date:", whois_info.creation_date)
91+
```
92+
93+
### Get Domain Expiration Date
94+
95+
Use the `check_registration` function to return the domain name expiration date:
96+
97+
```
98+
domain_name = "github.com"
99+
if check_registration(domain_name):
100+
whois_info = whois.whois(domain_name)
101+
print("Expiration date:", whois_info.expiration_date)
102+
```
103+
104+
### Get Domain Registration Email
105+
106+
Use the `check_registration` function to return the domain name registration email address:
107+
108+
```
109+
domain_name = "github.com"
110+
if check_registration(domain_name):
111+
whois_info = whois.whois(domain_name)
112+
print("email addresses:", whois_info.emails)
113+
```
114+
115+
### Get Domain Registration Location
116+
117+
Use the `check_registration` function to return the domain name registration location:
118+
119+
```
120+
domain_name = "github.com"
121+
if check_registration(domain_name):
122+
whois_info = whois.whois(domain_name)
123+
print("address:", whois_info.address)
124+
print("city:", whois_info.city)
125+
print("state:", whois_info.state)
126+
print("zip code:", whois_info.zipcode)
127+
print("country:", whois_info.country)
128+
```
129+
130+
### Get All Domain Registration Information
131+
132+
Use the `check_registration` function to return all domain name registration information:
133+
134+
```
135+
domain_name = "github.com"
136+
if check_registration(domain_name):
137+
whois_info = whois.whois(domain_name)
138+
print(whois_info)
139+
```
140+
141+
## Resources
142+
- [Official Python Download](https://www.python.org/downloads/)
143+
- [Python WHOIS Package](https://pypi.org/project/python-whois/)

‎docs/Get-HTTP-Links.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Get HTTP Links
2+
3+
## Table of Contents
4+
- [Background](#background)
5+
- [Use Case](#use-case)
6+
- [Prerequisites](#prerequisites)
7+
- [Usage](#usage)
8+
- [Resources](#resources)
9+
10+
## Background
11+
12+
## Use Case
13+
14+
## Prerequisites
15+
16+
The Python HTTP scanner requires the [latest version of Python 3](https://www.python.org/downloads/). The Python HTTP scanner also needs the PIP3 Python package manager, which is included with the latest version of Python 3.
17+
18+
Use PIP3 to install the Python packages required to use the HTTP scanner by running the following in a terminal:
19+
20+
```
21+
pip3 install -r requirements.txt
22+
```
23+
24+
## Usage
25+
26+
The [http-scanner.py](/programs/http-scanner/http-scanner.py) program runs with positional arguments. The last argument is the target domain being scanned. The -m argument specifies the maximum number of links to scan. The default number of links crawled is 30 if no -m argument is specified. For example, all internal and external links will be enumerated for the first 10 internal pages crawled if the -m argument is set to 10:
27+
28+
```
29+
python http-scanner.py -m 10 https://hackthissite.org
30+
```
31+
32+
The HTTP scanner outputs a .txt file with internal links of the target domain pages and another .txt file with external links from the target domain pages. For instance, for the scan `python http-scanner.py -m 10 https://hackthissite.org` will enumerate internal links in the file www.hackthissite.org_internal_links.txtand will enumerate external links to the file www.hackthissite.org_external_links.txt.
33+
34+
## Resources
35+
- [Official Python Download](https://www.python.org/downloads/)
36+
- [http-scanner.py](/programs/http-scanner/http-scanner.py)
37+
- [http-scanner.py requirements file](/programs/http-scanner/requirements.txt)

‎docs/Get-Port-Information.md

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Get Port Information
2+
3+
## Topics
4+
5+
- [Background](#background)
6+
- [Use Case](#use-case)
7+
- [Prerequisites](#prerequisites)
8+
- [Usage](#usage)
9+
- [Resources](#resources)
10+
11+
## Background
12+
13+
## Use Case
14+
15+
## Prerequisites
16+
17+
- Install the latest version of Python 3
18+
- Use PIP to install Scapy: `pip install --pre scapy[basic]`
19+
- Install any platform specific dependencies https://scapy.readthedocs.io/en/latest/installation.html#platform-specific-instructions
20+
- Run scapy with root permissions, for instance in an administrative cokmmand prompt
21+
22+
## Usage
23+
24+
Start Scapy:
25+
```C:\>scapy```
26+
27+
Run SYN Scans
28+
```
29+
sr1(IP(dst="72.14.207.99")/TCP(dport=80,flags="S"))
30+
```
31+
32+
The above will send a single SYN packet to Google’s port 80 and will quit after receiving a single response:
33+
34+
Use either notations to scan ports 400 through 443 on the system:
35+
```
36+
sr(IP(dst="192.168.1.1")/TCP(sport=666,dport=(440,443),flags="S"))
37+
```
38+
39+
```
40+
sr(IP(dst="192.168.1.1")/TCP(sport=RandShort(),dport=[440,441,442,443],flags="S"))
41+
```
42+
43+
https://resources.infosecinstitute.com/topic/port-scanning-using-scapy/
44+
45+
https://gist.github.com/mic159/c7133509af81dad409b79b8c4838f4bd
46+
47+
## Resources
48+
-[Scapy Documentation](https://scapy.readthedocs.io/en/latest/)
49+
-[Scapy GitHub Repository](https://github.com/secdev/scapy)
50+
- [Scapy Project Page](https://github.com/secdev/scapy)

‎docs/Get-Subdomain-Information.md

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Get Subdomain Information
2+
3+
This page describes how to enumerate subdomains of a given domain by using the [subdomain-scanner.py](/programs/subdomain-scanner/subdomain-scanner.py) Python program.
4+
5+
## Topics
6+
7+
- [Background](#background)
8+
- [Use Case](#use-case)
9+
- [Prerequisites](#prerequisites)
10+
- [Usage](#usage)
11+
- [Resources](#resources)
12+
13+
## Background
14+
15+
The Domain Name System heirarchy structure allows a domain name to be broken down into parts known as subdomains. Subdomains are defined by editing the DNS zone file for the domain name. Enumerating subdomains for a given domain can denote the domain structure. [subdomain-scanner.py](/programs/subdomain-scanner/subdomain-scanner.py) uses a list of potential subdomain names and the Python requests library to enumerate the subdomains of a given domain name.
16+
17+
## Use Case
18+
19+
Use this tool to determine the subdomains for a given domain. Enumerating subdomains can be particularly useful for testing the security of a domain. Internet facing services are often hosted on subdomains; for instance `vpn.domain-name.com`. Enunerating subdomains can be an initial step for testing the security of those services. Only run the domain enumeration tool against domains that have given express permission to do so. Running the domain enumeration tool against websites without permission while likely break the terms of service of that domain.
20+
21+
## Prerequisites
22+
23+
The Python requests package must be installed to utilize the subdomain enumeration functionality. The [latest version of Python 3](https://www.python.org/downloads/) is required to run the Python requests package. The PIP3 Python package manager is required to install the Python requests package. PIP3 is included with the latest version of Python 3.
24+
25+
Use PIP3 to Install the Python requests package by running the following in a terminal:
26+
27+
```
28+
pip3 install requests
29+
```
30+
31+
A list of subdomain names to test must be created in a .txt file, such as [subdomain-list.txt](/programs/subdomain-scanner/subdomain-list.txt). The program will return names from the list that are valid subdomain names of the given domain.
32+
33+
## Usage
34+
35+
The [subdomain-scanner.py](/programs/subdomain-scanner/subdomain-scanner.py) program runs with positional arguments. The last argument is the domain being scanned. The `-l` argument specifies the word list text file. The `-t` argument specifies the number of threads that the program should dedicate to scanning the domain:
36+
37+
```
38+
python subdomain-scanner.py -l subdomain-list.txt -t 10 hackthissite.org
39+
```
40+
41+
The `-h` argument can also be used to display the help message:
42+
43+
```
44+
python subdomain-scanner.py -h
45+
```
46+
47+
The program will ouput the subdomain that it discovers, such as:
48+
49+
```
50+
[+] Discovered subdomain: http://mail.hackthissite.org
51+
```
52+
53+
## Resources
54+
- [Official Python Download](https://www.python.org/downloads/)
55+
- [Python Requests Package](https://pypi.org/project/requests/)
56+
- [subdomain-scanner.py](/programs/subdomain-scanner/subdomain-scanner.py)
57+
- [subdomain-list.txt](/programs/subdomain-scanner/subdomain-list.txtsubdomain-list.txt)
58+
- [subdomain-list-medium.txt](/programs/subdomain-scanner/subdomain-list-medium.txt)
59+
- [subdomain-list-large.txt](/programs/subdomain-scanner/subdomain-list-large.txt)

0 commit comments

Comments
 (0)