agent-bypass 2.11.7 → 2.13.0

package/scripts/fastrecon.py

@@ -14,6 +14,9 @@
   fastrecon.py scan 10.0.0.0/24 -p 22,80,443 -t 0.6
   fastrecon.py http urls.txt -b 48                 # HTTP 批量探测（curl -Z 并行）
   fastrecon.py http https://a.com,https://b.com --code
+  fastrecon.py sub example.com                     # 子域枚举（词典爆破 + 通配符检测）
+  fastrecon.py sub a.com,b.com --ct                # 多根 + 证书透明度日志并入
+  fastrecon.py multi example.com,github.com        # 多域名情报（A/NS/MX/TXT 汇总）
 
 纯标准库（socket/selectors/struct/subprocess/urllib）；无 root 依赖；Termux/iSH 通用。
 Python 3.8+。退出码：0 正常 / 1 用法错误 / 2 参数或目标非法。
@@ -56,12 +59,18 @@ def _shq(s):
     if s and all(c in _SAFE for c in s): return s
     return "'%s'" % s.replace("'", "'" + chr(92) + "'" + "'")
 def _run_curl(cargs):
+    if os.name == 'nt':                 # Windows cmd 不识别单引号与 /dev/null：走列表调用
+        try:
+            r = _sp().run(cargs, capture_output=True, encoding='utf-8', errors='replace')
+            return r.stdout or ''
+        except Exception:
+            return ''
     p = os.popen(" ".join(_shq(a) for a in cargs) + " 2>/dev/null")
     out = p.read(); p.close(); return out
 import urllib.parse
 
 CACHE_FILE = os.path.expanduser('~/.fastrecon_cache.txt')
-FALLBACK_RESOLVERS = ['1.1.1.1', '8.8.8.8']
+FALLBACK_RESOLVERS = ['1.1.1.1', '9.9.9.9', '223.5.5.5', '8.8.8.8']   # 8.8.8.8 境内常被墙，置末
 MAX_DNS_WORKERS = 256
 MAX_SCAN_WORKERS = 1024
 MAX_HTTP_BATCH = 256
@@ -151,11 +160,15 @@ def read_targets(t):
 
 
 def load_resolvers(override=None):
-    """resolver 列表；只接受 IPv4 字面量（UDP 查询走 AF_INET），去重保序"""
+    """resolver 列表：跳过 fake-ip 网关（Clash/mihomo 系 198.18.0.0/15 假 DNS，
+    返回值不是真实 IP）；系统无真 DNS 时探测公共（带缓存）；纯 fake 环境保留
+    原 resolver 兜底（子域存在性判定仍有效）。平台：Linux/macOS 读
+    /etc/resolv.conf；Windows 无该文件 → 直接走公共探测。
+    """
     if override:
         o = override.strip().strip('[]').split('%')[0]
         return [o] if _is_ipv4(o) else []
-    rs = []
+    raw, rs = [], []
     try:
         with open('/etc/resolv.conf', encoding='utf-8', errors='ignore') as f:
             for line in f:
@@ -163,11 +176,74 @@ def load_resolvers(override=None):
                 if not m:
                     continue
                 a = m.group(1).strip('[]').split('%')[0]
-                if _is_ipv4(a) and a not in rs:
+                if not _is_ipv4(a):
+                    continue
+                if a not in raw:
+                    raw.append(a)
+                if not _is_fakeip(a) and a not in rs:
                     rs.append(a)
     except OSError:
         pass
-    return rs or list(FALLBACK_RESOLVERS)
+    if rs:
+        return rs
+    if raw:
+        _warn('检测到 fake-ip 网关（%s），自动改用公共 DNS' % ','.join(raw))
+    pub = healthy_resolvers()
+    if pub:
+        return pub
+    if raw:
+        _warn('公共 DNS 不可达：保留原 resolver（IP 不可信，子域存在性判定仍有效）')
+    return raw or list(FALLBACK_RESOLVERS)
+
+
+def _is_fakeip(ip):
+    """fake-ip 段判定：RFC 2544 198.18.0.0/15（Clash/mihomo 默认）与 240.0.0.0/4"""
+    return ip.startswith('198.18.') or ip.startswith('198.19.') or ip.startswith('240.')
+
+
+_PROBE_NAME = 'www.apple.com'
+
+
+def _probe_resolver(srv, timeout=1.5):
+    """单台 resolver 健康检查：能解析出非 fake 记录即算健康；返回 (srv, 耗时秒)"""
+    t0 = time.time()
+    try:
+        r = dns_query(_PROBE_NAME, [srv], timeout=timeout)
+    except Exception:
+        return None
+    if r and any(not _is_fakeip(ip) for ip in r):
+        return (srv, time.time() - t0)
+    return None
+
+
+def healthy_resolvers(timeout=1.5, cache_ttl=300):
+    """并发探测公共 resolver 并按延迟排序；结果缓存到系统临时目录（跨平台）。
+    注意：探测失败（如纯 fake-ip 无逃逸环境）返回 []，由调用方兜底。
+    """
+    import json
+    import tempfile
+    path = os.path.join(tempfile.gettempdir(), 'fastrecon_dns_health.json')
+    try:
+        with open(path, encoding='utf-8') as f:
+            c = json.load(f)
+        if time.time() - c.get('ts', 0) < cache_ttl and c.get('ok'):
+            return list(c['ok'])
+    except Exception:
+        pass
+    cand = list(FALLBACK_RESOLVERS)
+    got = []
+    for x in _run_pool(cand, lambda s: _probe_resolver(s, timeout), len(cand)):
+        if x and isinstance(x[1], float):
+            got.append(x)
+    got.sort(key=lambda p: p[1])
+    ok = [s for s, _d in got]
+    if ok:
+        try:
+            with open(path, 'w', encoding='utf-8') as f:
+                json.dump({'ts': time.time(), 'ok': ok}, f)
+        except Exception:
+            pass
+    return ok
 
 
 # ============ DNS ============
@@ -213,11 +289,47 @@ def _skip_name(d, o):
             raise IndexError('too many labels')
 
 
-def _parse_answers(data):
-    """从应答中提取 ANSWER 段的 A 记录（其余类型跳过）；异常报文返回已解析部分"""
-    ips = []
+def _read_name(d, o):
+    """读取域名（含压缩指针），返回 (name, 新偏移)；结构异常抛 IndexError"""
+    parts = []
+    hops = 0
+    while True:
+        if o >= len(d):
+            raise IndexError('truncated name')
+        l = d[o]
+        if l == 0:
+            return ('.'.join(parts), o + 1)
+        if l & 0xC0 == 0xC0:
+            if o + 1 >= len(d):
+                raise IndexError('truncated pointer')
+            ptr = struct.unpack('>H', d[o:o + 2])[0] & 0x3FFF
+            hops += 1
+            if hops > 64:                   # 指针环防御
+                raise IndexError('pointer loop')
+            sub, _ = _read_name(d, ptr)
+            if sub:
+                parts.append(sub)
+            return ('.'.join(parts), o + 2)
+        if o + 1 + l > len(d) or l > 63:
+            raise IndexError('bad label')
+        raw = d[o + 1:o + 1 + l]
+        try:
+            parts.append(raw.decode('ascii'))
+        except UnicodeDecodeError:
+            parts.append(raw.decode('utf-8', 'replace'))
+        o += 1 + l
+        hops += 1
+        if hops > 128:
+            raise IndexError('too many labels')
+
+
+def _parse_answers(data, qtype=1):
+    """从应答 ANSWER 段提取指定类型记录；异常报文返回已解析部分。
+    qtype: 1=A 28=AAAA 2=NS 5=CNAME 15=MX 16=TXT，其余类型跳过。
+    """
+    out = []
     if len(data) < 12:
-        return ips
+        return out
     ancount = struct.unpack('>H', data[6:8])[0]
     o = 12
     try:
@@ -230,12 +342,31 @@ def _parse_answers(data):
             o += 10
             if o + ln > len(data):
                 break
-            if t == 1 and ln == 4:
-                ips.append('.'.join(str(b) for b in data[o:o + 4]))
+            rd = data[o:o + ln]
+            if t == qtype and ln > 0:
+                if t == 1 and ln == 4:
+                    out.append('.'.join(str(b) for b in rd))
+                elif t == 28 and ln == 16:
+                    out.append(str(ipaddress.IPv6Address(rd)))
+                elif t in (2, 5):           # NS / CNAME：单域名
+                    nm, _ = _read_name(data, o)
+                    out.append(nm)
+                elif t == 15 and ln > 3:    # MX：优先级 + 域名
+                    pref = struct.unpack('>H', rd[:2])[0]
+                    nm, _ = _read_name(data, o + 2)
+                    out.append('%d %s' % (pref, nm))
+                elif t == 16:               # TXT：拼接全部文本串
+                    txt, p = [], 0
+                    while p < ln:
+                        sl = rd[p]
+                        p += 1
+                        txt.append(rd[p:p + sl].decode('utf-8', 'replace'))
+                        p += sl
+                    out.append(''.join(txt))
             o += ln
     except (IndexError, struct.error):
         pass
-    return ips
+    return out
 
 
 def _recv_exact(s, want):
@@ -251,7 +382,7 @@ def _recv_exact(s, want):
     return buf
 
 
-def _dns_tcp_query(q, srv, timeout):
+def _dns_tcp_query(q, srv, timeout, qtype=1):
     """UDP 应答被截断（TC 位）时的 TCP 重发；失败返回 []（调用方保留部分结果）"""
     try:
         with socket.create_connection((srv, 53), timeout=timeout) as s:
@@ -266,12 +397,12 @@ def _dns_tcp_query(q, srv, timeout):
             body = _recv_exact(s, n)
             if len(body) < 12:
                 return []
-            return _parse_answers(body)
+            return _parse_answers(body, qtype)
     except OSError:
         return []
 
 
-def _dns_dot_query(q, srv, timeout):
+def _dns_dot_query(q, srv, timeout, qtype=1):
     """DNS over TLS（RFC 7858）：TCP 853 + TLS 包装，帧格式同 TCP。失败返回 []。"""
     try:
         import ssl
@@ -291,7 +422,7 @@ def _dns_dot_query(q, srv, timeout):
                 body = _recv_exact(s, n)
                 if len(body) < 12:
                     return []
-                return _parse_answers(body)
+                return _parse_answers(body, qtype)
     except OSError:
         return []
 
@@ -324,8 +455,8 @@ def _dns_exchange(sock, q, qidb, srv, timeout):
         # ID 不匹配 → 丢弃并继续等（防串包）
 
 
-def dns_query(name, servers, timeout=4.0, via="udp"):
-    """查询 A 记录。
+def dns_query(name, servers, timeout=4.0, via="udp", qtype=1):
+    """查询指定类型记录（qtype: 1=A 28=AAAA 2=NS 5=CNAME 15=MX 16=TXT）。
 
     返回 None：域名非法（未发查询）；返回 []：查询失败或确无 A 记录。
     """
@@ -336,13 +467,13 @@ def dns_query(name, servers, timeout=4.0, via="udp"):
     servers = [s for s in (servers or []) if _is_ipv4(s)] or list(FALLBACK_RESOLVERS)
     qid = random.randint(0, 65535)
     qidb = struct.pack('>H', qid)
-    head = struct.pack('>HHHHHH', qid, 0x0100, 1, 0, 0, 0) + qn + struct.pack('>HH', 1, 1)
+    head = struct.pack('>HHHHHH', qid, 0x0100, 1, 0, 0, 0) + qn + struct.pack('>HH', qtype, 1)
     # EDNS0：通告 4096 字节 UDP 缓冲，显著降低 TC 截断概率
-    q_edns = (struct.pack('>HHHHHH', qid, 0x0100, 1, 0, 0, 1) + qn + struct.pack('>HH', 1, 1)
+    q_edns = (struct.pack('>HHHHHH', qid, 0x0100, 1, 0, 0, 1) + qn + struct.pack('>HH', qtype, 1)
               + b'\x00' + struct.pack('>HHIH', 41, DNS_UDP_BUF, 0, 0))
     if via == 'dot':
         for srv in servers:
-            r = _dns_dot_query(head, srv, timeout)
+            r = _dns_dot_query(head, srv, timeout, qtype)
             if r:
                 return r
         return []
@@ -356,9 +487,9 @@ def dns_query(name, servers, timeout=4.0, via="udp"):
                 rcode = data[3] & 0x0F
                 if rcode in (1, 4) and q is q_edns:
                     continue
-                ips = _parse_answers(data)
+                ips = _parse_answers(data, qtype)
                 if (data[2] & 0x02) and not ips:            # TC 截断且没拿到 A → TCP
-                    tcp = _dns_tcp_query(q, srv, timeout)
+                    tcp = _dns_tcp_query(q, srv, timeout, qtype)
                     if tcp:
                         return tcp
                 if rcode in (0, 3) or ips:                  # NOERROR / NXDOMAIN / 有 A
@@ -368,7 +499,7 @@ def dns_query(name, servers, timeout=4.0, via="udp"):
         sock.close()
     if via == 'auto':
         for srv in servers:                 # UDP 全挂 → DoT 853 兜底
-            r = _dns_dot_query(head, srv, timeout)
+            r = _dns_dot_query(head, srv, timeout, qtype)
             if r:
                 return r
     return []
@@ -387,7 +518,8 @@ def cache_load():
                 if len(parts) < 2:
                     continue
                 k, v = parts[0].strip(), parts[1].strip()
-                if k and v and _is_addr_list(v):
+                # 历史 fake-ip 缓存行作废（fake-ip 代理切换前后可能残留，见 _is_fakeip）
+                if k and v and _is_addr_list(v) and not all(_is_fakeip(x) for x in v.split(',')):
                     c[k] = v
     except OSError:
         pass
@@ -533,9 +665,13 @@ def cmd_dns(args):
         if ips is None:
             print(f'{n}\t-\t[非法域名]')
         elif ips:
-            print(f'{n}\t{",".join(ips)}')
+            real = [x for x in ips if not _is_fakeip(x)]
+            if not real:
+                print(f'{n}\t[fake-ip 区结果：IP 不可信，存在性有效]')
+                continue
+            print(f'{n}\t{",".join(real)}')
             k = keys[n]
-            val = ','.join(ips)
+            val = ','.join(real)
             # 同名（含大小写/尾部点差异）只写一行，避免缓存重复行堆积
             if not cache.get(k) and k not in written:
                 written.add(k)
@@ -928,6 +1064,309 @@ def cmd_http(args):
     return 0
 
 
+# ============ 子域枚举 ============
+
+SUB_WORDS = (
+    'www www2 www3 mail webmail smtp pop imap ftp sftp ssh vpn rdp remote '
+    'api api2 apidocs developer docs doc wiki blog news forum bbs shop store pay payment '
+    'checkout cart admin admincp administrator manage manager mgmt console portal '
+    'dashboard panel cp cpanel plesk cms content static assets cdn cache img images '
+    'media video files download downloads upload uploads backup bak db database sql mysql '
+    'postgres redis mongo es kibana grafana prometheus monitor status git gitlab svn '
+    'jenkins ci cd build deploy staging dev development test testing uat qa demo beta '
+    'sandbox lab intranet internal corp lan ns ns1 ns2 dns dns1 dns2 mx mx1 mx2 relay '
+    'gateway gw proxy prx lb lb1 lb2 vip edge origin auth sso login oauth token session '
+    'identity ad click track analytics stats stat log logs syslog elastic elk kafka mq '
+    'queue rabbitmq notify push mailer crm erp hr oa bi report reports data bigdata app '
+    'app1 app2 mobile m wap open openapi public private secure ssl ca pki cert certs '
+    'k8s docker registry harbor nexus artifacts maven npm pypi phpmyadmin pma debug '
+    'actuator solr search jupyter spark hadoop zabbix oa2 erp2 crm2 hr2 git2 svn2 old new'
+).split()
+
+_SUB_LABEL_RE = re.compile(r'^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$')
+
+
+def _norm_domain(d):
+    """裸主域合法性检查；非法返回 None（不接受通配符前缀与路径）"""
+    if not d:
+        return None
+    d = d.strip().rstrip('.').lower()
+    if not d or '*' in d or '/' in d or len(d) > 253:
+        return None
+    labels = d.split('.')
+    if len(labels) < 2:
+        return None
+    for lb in labels:
+        if not _SUB_LABEL_RE.match(lb):
+            return None
+    return d
+
+
+def _ct_log_names(domain, timeout=20):
+    """crt.sh 证书透明度日志（间歇 404/502 波动，退避重试）；失败返回空集由其它源兜底。"""
+    import json
+    import urllib.request
+    url = 'https://crt.sh/json?q=%25.' + domain
+    data, last = None, None
+    for attempt in range(3):
+        try:
+            req = urllib.request.Request(url, headers={'User-Agent': 'fastrecon-sub'})
+            with urllib.request.urlopen(req, timeout=timeout) as r:
+                data = json.loads(r.read().decode('utf-8', 'replace'))
+            break
+        except Exception as e:
+            last = e
+            time.sleep(0.6 * (attempt + 1))
+    if data is None:
+        _warn('crt.sh 暂不可用: %s' % str(last)[:60])
+        return set()
+    names = set()
+    if isinstance(data, list):
+        for row in data:
+            nv = row.get('name_value') or ''
+            for nm in str(nv).split('\n'):
+                nm = nm.strip().lower().rstrip('.')
+                if nm.startswith('*.'):
+                    nm = nm[2:]
+                if (nm.endswith('.' + domain) or nm == domain) and _norm_domain(nm):
+                    names.add(nm)
+    return names
+
+
+def _certspotter_names(domain, timeout=25):
+    """Cert Spotter CT 日志（免费 API，crt.sh 的可靠兜底源）：返回名字集合。"""
+    import json
+    import urllib.request
+    url = ('https://api.certspotter.com/v1/issuances?domain=' + domain
+           + '&include_subdomains=true&expand=dns_names')
+    try:
+        req = urllib.request.Request(url, headers={'User-Agent': 'fastrecon-sub'})
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            data = json.loads(r.read().decode('utf-8', 'replace'))
+    except Exception:
+        return set()
+    names = set()
+    if isinstance(data, list):
+        for row in data:
+            if not isinstance(row, dict):
+                continue
+            for nm in (row.get('dns_names') or []):
+                nm = str(nm).strip().lower().rstrip('.')
+                if nm.startswith('*.'):
+                    nm = nm[2:]
+                if (nm.endswith('.' + domain) or nm == domain) and _norm_domain(nm):
+                    names.add(nm)
+    return names
+
+
+def _hackertarget_subs(domain, timeout=15):
+    """hackertarget hostsearch（免费接口，有日限额，超限/异常返回空集）。"""
+    import urllib.request
+    try:
+        req = urllib.request.Request(
+            'https://api.hackertarget.com/hostsearch/?q=' + domain,
+            headers={'User-Agent': 'fastrecon-sub'})
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            txt = r.read().decode('utf-8', 'replace')
+    except Exception:
+        return set()
+    out = set()
+    for line in txt.splitlines():
+        nm = line.split(',')[0].strip().lower().rstrip('.')
+        if nm.endswith('.' + domain) and _norm_domain(nm):
+            out.add(nm)
+    return out
+
+
+def _rapiddns_subs(domain, timeout=20):
+    """rapiddns 子域页（HTML 表格解析；被 WAF 拦时返回空集）。"""
+    import urllib.request
+    try:
+        req = urllib.request.Request(
+            'https://rapiddns.io/subdomain/%s?full=1' % domain,
+            headers={'User-Agent': 'Mozilla/5.0'})
+        with urllib.request.urlopen(req, timeout=timeout) as r:
+            html = r.read().decode('utf-8', 'replace')
+    except Exception:
+        return set()
+    pat = r'<td[^>]*>\s*([A-Za-z0-9._-]+\.' + re.escape(domain) + r')\s*</td>'
+    return set(m.lower() for m in re.findall(pat, html) if _norm_domain(m))
+
+
+def _sub_candidates(domain, words, use_ct=True, progress=False):
+    """组合候选集（含来源追踪）；返回 (候选集合, {名字: 来源标签集合})。
+    数据源：词典 + apex/www + 外部源聚合（crt.sh / certspotter / hackertarget / rapiddns 并发，失败静默）
+    """
+    cand, srcmap = set(), {}
+
+    def add(name, src):
+        cand.add(name)
+        srcmap.setdefault(name, set()).add(src)
+
+    add(domain, 'apex')
+    add('www.' + domain, 'dict')
+    for w in words:
+        w = w.strip().lower()
+        if w and _SUB_LABEL_RE.match(w):
+            add(w + '.' + domain, 'dict')
+    if use_ct:
+        if progress:
+            _warn('聚合外部源（crt.sh / certspotter / hackertarget / rapiddns）...')
+        srcs = (('crt.sh', _ct_log_names),
+                ('certspotter', _certspotter_names),
+                ('hackertarget', _hackertarget_subs),
+                ('rapiddns', _rapiddns_subs))
+
+        def one_src(item):
+            label, fn = item
+            try:
+                return label, (fn(domain) or set())
+            except Exception:
+                return label, set()
+
+        for label, names in _run_pool(list(srcs), one_src, len(srcs)):
+            if not isinstance(names, set):
+                continue                # _run_pool 异常占位行
+            if progress and names:
+                _warn('%s 贡献 %d 个名字' % (label, len(names)))
+            for nm in names:
+                add(nm, label)
+    return cand, srcmap
+
+
+def _rec_key(recs):
+    """结果归一化键：纯 fake-ip 结果统一为一类（fake 环境各域名分到不同假 IP，
+    无法按具体 IP 比对泛解析噪声）"""
+    if recs and all(_is_fakeip(ip) for ip in recs):
+        return 'FAKE'
+    return ','.join(recs)
+
+
+def cmd_sub(args):
+    domain = _norm_domain(args.domain)
+    if not domain:
+        _err('主域非法: %r' % args.domain)
+        return 2
+    workers = _clamp_int(args.workers, 1, MAX_DNS_WORKERS, 50)
+    timeout = _clamp_float(args.timeout, 0.2, 60.0, 3.0)
+    servers = load_resolvers(args.resolver) or list(FALLBACK_RESOLVERS)
+    words = list(SUB_WORDS)
+    if args.wordlist:
+        try:
+            with open(args.wordlist, encoding='utf-8', errors='ignore') as f:
+                words += [ln.strip() for ln in f]
+        except OSError as e:
+            _err('词典读取失败: %s' % e)
+            return 2
+    t0 = time.time()
+    print('[*] 目标: %s' % domain, file=sys.stderr)
+
+    # 1. 通配符检测：随机子域 + 主域对照
+    probe_w = 'ck%06x.%s' % (random.randint(0, 0xFFFFFF), domain)
+    try:
+        probe_wild = dns_query(probe_w, servers, timeout=timeout, via='udp') or []
+        probe_apex = dns_query(domain, servers, timeout=timeout, via='udp') or []
+    except Exception:
+        probe_wild, probe_apex = [], []
+    if probe_wild:
+        pv = ','.join(ip for ip in probe_wild if not _is_fakeip(ip)) or '[fake-ip 段]'
+        print('[!] 泛解析: *.%s → %s（默认过滤同记录噪声，--all 显示全部）'
+              % (domain, pv), file=sys.stderr)
+
+    # 2. 候选生成 + 并发解析（逐条实时打印）
+    cand_set, srcmap = _sub_candidates(domain, words, use_ct=not args.no_ct, progress=True)
+    cand = sorted(cand_set)
+    _warn('候选 %d 个，开始并发解析 ...' % len(cand))
+    ok, done = [], [0]
+
+    def one(nm):
+        try:
+            recs = dns_query(nm, servers, timeout=timeout, via='udp')
+        except Exception:
+            recs = []
+        done[0] += 1
+        if done[0] % 50 == 0:
+            _warn('进度 %d/%d' % (done[0], len(cand)))
+        return nm, recs or []
+
+    pw, pa = _rec_key(probe_wild), _rec_key(probe_apex)
+    for nm, recs in _run_pool(cand, one, workers):
+        if not recs:
+            continue
+        if not args.all:
+            if probe_wild and _rec_key(recs) == pw:
+                continue                # 与泛解析记录同类 → 噪声
+            if probe_apex and _rec_key(recs) == pa and nm != domain:
+                continue                # 与主域同类 → 常见 CDN 噪声
+        ok.append((nm, recs))
+        real = [ip for ip in recs if not _is_fakeip(ip)]
+        if real:
+            if args.src:
+                print('%s\t%s\t[%s]' % (nm, ','.join(real),
+                                        ','.join(sorted(srcmap.get(nm, ())))))
+            else:
+                print('%s\t%s' % (nm, ','.join(real)))
+        else:
+            print('%s\t[仅 fake-ip：IP 不可信，存在性有效]' % nm)
+    xsrc = sum(1 for nm, _r in ok if len(srcmap.get(nm) or ()) > 1)
+    print('[完成] %s: 存活 %d（多源交叉 %d）/ 候选 %d / %.1fs'
+          % (domain, len(ok), xsrc, len(cand), time.time() - t0), file=sys.stderr)
+    return 0
+
+
+# ============ 多域名 DNS 情报 ============
+
+_QTYPES = ((1, 'A'), (28, 'AAAA'), (5, 'CNAME'), (2, 'NS'), (15, 'MX'), (16, 'TXT'))
+_TYPE_BY_NAME = {n: q for q, n in _QTYPES}
+
+
+def _multi_get(domain, types, servers, timeout):
+    out = {}
+    for q, label in types:
+        try:
+            r = dns_query(domain, servers, timeout=timeout, via='udp', qtype=q)
+        except Exception:
+            r = []
+        if q == 1:                          # A 记录：剔除 fake-ip 段
+            r = [ip for ip in r if not _is_fakeip(ip)]
+        if r:
+            out[label] = r
+    return out
+
+
+def cmd_multi(args):
+    domains = []
+    for d in read_targets(args.target):
+        nd = _norm_domain(d)
+        if nd:
+            domains.append(nd)
+        else:
+            _warn('跳过非法域名: %r' % d)
+    if not domains:
+        _err('未提供有效域名')
+        return 2
+    servers = load_resolvers(args.resolver) or list(FALLBACK_RESOLVERS)
+    timeout = _clamp_float(args.timeout, 0.2, 60.0, 4.0)
+    types = list(_QTYPES)
+    if args.types:
+        pick = [(_TYPE_BY_NAME[t], t) for t in
+                (x.strip().upper() for x in args.types.split(',')) if t in _TYPE_BY_NAME]
+        if pick:
+            types = pick
+    t0 = time.time()
+    for d in domains:
+        print('=== %s ===' % d)
+        rec = _multi_get(d, types, servers, timeout)
+        if not rec:
+            print('  (无记录)')
+            continue
+        for _q, label in types:
+            for v in rec.get(label, []):
+                print('  %-5s %s' % (label, v))
+    print('[完成] %d 域名 / %.1fs' % (len(domains), time.time() - t0), file=sys.stderr)
+    return 0
+
+
 # ============ 入口 ============
 
 def main():
@@ -959,11 +1398,29 @@ def main():
     h.add_argument('-t', '--timeout', type=int, default=8)
     h.add_argument('--code', action='store_true', help='只输出 URL 和状态码')
 
+    u = sub.add_parser('sub', help='子域枚举（词典爆破 + CT 日志 + 通配符过滤）')
+    u.add_argument('domain', help='主域（example.com）')
+    u.add_argument('-w', '--wordlist', help='追加自定义词典（每行一个前缀）')
+    u.add_argument('--no-ct', action='store_true', help='跳过外部数据源（纯爆破快速模式）')
+    u.add_argument('--all', action='store_true', help='显示全部（含泛解析噪声）')
+    u.add_argument('--src', action='store_true', help='输出行附加来源标注（多源交叉）')
+    u.add_argument('--resolver', help='指定 resolver（默认自动探测）')
+    u.add_argument('-j', '--workers', type=int, default=platf.env()['dns_workers'],
+                   help='并发数（按平台自动适配）')
+    u.add_argument('-t', '--timeout', type=float, default=3, help='单查询超时（默认 3s）')
+
+    m = sub.add_parser('multi', help='多域名情报（A/AAAA/CNAME/NS/MX/TXT 汇总）')
+    m.add_argument('target', help='域名 / 逗号列表 / 文件')
+    m.add_argument('--types', help='类型子集，如 A,MX,TXT（默认全部）')
+    m.add_argument('--resolver', help='指定 resolver（默认自动探测）')
+    m.add_argument('-t', '--timeout', type=float, default=4, help='单查询超时（默认 4s）')
+
     args = ap.parse_args()
     if not args.cmd:
         ap.print_help()
         return 1
-    return {'dns': cmd_dns, 'scan': cmd_scan, 'http': cmd_http}[args.cmd](args)
+    return {'dns': cmd_dns, 'scan': cmd_scan, 'http': cmd_http,
+            'sub': cmd_sub, 'multi': cmd_multi}[args.cmd](args)
 
 
 if __name__ == '__main__':