oneforall-kjl 0.1.1__py3-none-any.whl

OneForAll/modules/search/gitee.py

@@ -0,0 +1,71 @@
+import time
+from bs4 import BeautifulSoup
+from common.search import Search
+from config.log import logger
+
+
+class Gitee(Search):
+    def __init__(self, domain):
+        Search.__init__(self)
+        self.source = 'GiteeSearch'
+        self.module = 'Search'
+        self.addr = 'https://search.gitee.com/'
+        self.domain = domain
+
+    def search(self):
+        """
+        向接口查询子域并做子域匹配
+        """
+        page_num = 1
+        while True:
+            time.sleep(self.delay)
+            self.header = self.get_header()
+            self.proxy = self.get_proxy(self.source)
+            params = {'pageno': page_num, 'q': self.domain, 'type': 'code'}
+            try:
+                resp = self.get(self.addr, params=params)
+            except Exception as e:
+                logger.log('ERROR', e.args)
+                break
+            if not resp:
+                break
+            if resp.status_code != 200:
+                logger.log('ERROR', f'{self.source} module query failed')
+                break
+            if 'class="empty-box"' in resp.text:
+                break
+            soup = BeautifulSoup(resp.text, 'html.parser')
+            subdomains = self.match_subdomains(soup, fuzzy=False)
+            if not self.check_subdomains(subdomains):
+                break
+            self.subdomains.update(subdomains)
+            if '<li class="disabled"><a href="###">' in resp.text:
+                break
+            page_num += 1
+            if page_num >= 100:
+                break
+
+    def run(self):
+        """
+        类执行入口
+        """
+        self.begin()
+        self.search()
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def run(domain):
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    query = Gitee(domain)
+    query.run()
+
+
+if __name__ == '__main__':
+    run('qq.com')

OneForAll/modules/search/github_api.py

@@ -0,0 +1,86 @@
+import time
+
+from config import settings
+from common.search import Search
+from config.log import logger
+
+
+class GithubAPI(Search):
+    def __init__(self, domain):
+        Search.__init__(self)
+        self.source = 'GithubAPISearch'
+        self.module = 'Search'
+        self.addr = 'https://api.github.com/search/code'
+        self.domain = domain
+        self.delay = 5
+        self.token = settings.github_api_token
+
+    def search(self):
+        """
+        向接口查询子域并做子域匹配
+        """
+        self.header = self.get_header()
+        self.proxy = self.get_proxy(self.source)
+        self.header.update(
+            {'Accept': 'application/vnd.github.v3.text-match+json'})
+        self.header.update(
+            {'Authorization': 'token ' + self.token})
+
+        page = 1
+        while True:
+            time.sleep(self.delay)
+            params = {'q': self.domain, 'per_page': 100,
+                      'page': page, 'sort': 'indexed',
+                      'access_token': self.token}
+            try:
+                resp = self.get(self.addr, params=params)
+            except Exception as e:
+                logger.log('ERROR', e.args)
+                break
+            if not resp or resp.status_code != 200:
+                logger.log('ERROR', f'{self.source} module query failed')
+                break
+            subdomains = self.match_subdomains(resp)
+            if not subdomains:
+                break
+            self.subdomains.update(subdomains)
+            page += 1
+            try:
+                resp_json = resp.json()
+            except Exception as e:
+                logger.log('ERROR', e.args)
+                break
+            total_count = resp_json.get('total_count')
+            if not isinstance(total_count, int):
+                break
+            if page * 100 > total_count:
+                break
+            if page * 100 > 1000:
+                break
+
+    def run(self):
+        """
+        类执行入口
+        """
+        if not self.have_api(self.token):
+            return
+        self.begin()
+        self.search()
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def run(domain):
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    query = GithubAPI(domain)
+    query.run()
+
+
+if __name__ == '__main__':
+    run('freebuf.com')

OneForAll/modules/search/google.py

@@ -0,0 +1,83 @@
+import random
+import time
+from common.search import Search
+
+
+class Google(Search):
+    def __init__(self, domain):
+        Search.__init__(self)
+        self.domain = domain
+        self.module = 'Search'
+        self.source = 'GoogleSearch'
+        self.init = 'https://www.google.com/'
+        self.addr = 'https://www.google.com/search'
+
+    def search(self, domain, filtered_subdomain=''):
+        """
+        发送搜索请求并做子域匹配
+
+        :param str domain: 域名
+        :param str filtered_subdomain: 过滤的子域
+        """
+        page_num = 1
+        per_page_num = 50
+        self.header = self.get_header()
+        self.header.update({'User-Agent': 'Googlebot',
+                            'Referer': 'https://www.google.com'})
+        self.proxy = self.get_proxy(self.source)
+        resp = self.get(self.init)
+        if not resp:
+            return
+        self.cookie = resp.cookies
+        while True:
+            self.delay = random.randint(1, 5)
+            time.sleep(self.delay)
+            self.proxy = self.get_proxy(self.source)
+            word = 'site:.' + domain + filtered_subdomain
+            payload = {'q': word, 'start': page_num, 'num': per_page_num,
+                       'filter': '0', 'btnG': 'Search', 'gbv': '1', 'hl': 'en'}
+            resp = self.get(url=self.addr, params=payload)
+            subdomains = self.match_subdomains(resp, fuzzy=False)
+            if not self.check_subdomains(subdomains):
+                break
+            self.subdomains.update(subdomains)
+            page_num += per_page_num
+            if 'start=' + str(page_num) not in resp.text:
+                break
+            if '302 Moved' in resp.text:
+                break
+
+    def run(self):
+        """
+        类执行入口
+        """
+        self.begin()
+
+        self.search(self.domain)
+
+        # 排除同一子域搜索结果过多的子域以发现新的子域
+        for statement in self.filter(self.domain, self.subdomains):
+            self.search(self.domain, filtered_subdomain=statement)
+
+        # 递归搜索下一层的子域
+        if self.recursive_search:
+            for subdomain in self.recursive_subdomain():
+                self.search(subdomain)
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def run(domain):
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    search = Google(domain)
+    search.run()
+
+
+if __name__ == '__main__':
+    run('example.com')

OneForAll/modules/search/google_api.py

@@ -0,0 +1,77 @@
+import time
+from config import settings
+from common.search import Search
+
+
+class GoogleAPI(Search):
+    def __init__(self, domain):
+        Search.__init__(self)
+        self.domain = domain
+        self.module = 'Search'
+        self.source = 'GoogleAPISearch'
+        self.addr = 'https://www.googleapis.com/customsearch/v1'
+        self.delay = 1
+        self.key = settings.google_api_key
+        self.id = settings.google_api_id
+        self.per_page_num = 10  # 每次只能请求10个结果
+
+    def search(self, domain, filtered_subdomain=''):
+        """
+        发送搜索请求并做子域匹配
+
+        :param str domain: 域名
+        :param str filtered_subdomain: 过滤的子域
+        """
+        self.page_num = 1
+        while True:
+            word = 'site:.' + domain + filtered_subdomain
+            time.sleep(self.delay)
+            self.header = self.get_header()
+            self.proxy = self.get_proxy(self.source)
+            params = {'key': self.key, 'cx': self.id,
+                      'q': word, 'fields': 'items/link',
+                      'start': self.page_num, 'num': self.per_page_num}
+            resp = self.get(self.addr, params)
+            subdomains = self.match_subdomains(resp)
+            if not self.check_subdomains(subdomains):
+                break
+            self.subdomains.update(subdomains)
+            self.page_num += self.per_page_num
+            if self.page_num > 100:  # 免费的API只能查询前100条结果
+                break
+
+    def run(self):
+        """
+        类执行入口
+        """
+        if not self.have_api(self.id, self.key):
+            return
+        self.begin()
+        self.search(self.domain)
+
+        # 排除同一子域搜索结果过多的子域以发现新的子域
+        for statement in self.filter(self.domain, self.subdomains):
+            self.search(self.domain, filtered_subdomain=statement)
+
+        # 递归搜索下一层的子域
+        if self.recursive_search:
+            for subdomain in self.recursive_subdomain():
+                self.search(subdomain)
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def run(domain):
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    search = GoogleAPI(domain)
+    search.run()
+
+
+if __name__ == '__main__':
+    run('mi.com')

OneForAll/modules/search/hunter_api.py

@@ -0,0 +1,72 @@
+import base64
+import time
+
+from config import settings
+from common.search import Search
+
+
+class Hunter(Search):
+    def __init__(self, domain):
+        Search.__init__(self)
+        self.domain = domain
+        self.module = 'Search'
+        self.source = 'HunterAPISearch'
+        self.addr = 'https://hunter.qianxin.com/openApi/search'
+        self.delay = 1
+        self.key = settings.hunter_api_key
+
+    def search(self):
+        """
+        发送搜索请求并做子域匹配
+        """
+        self.page_num = 1
+        subdomain_encode = f'domain_suffix="{self.domain}"'.encode('utf-8')
+        query_data = base64.b64encode(subdomain_encode)
+        while 100 * self.page_num < settings.cam_records_maximum_per_domain:
+            time.sleep(self.delay)
+            self.header = self.get_header()
+            self.proxy = self.get_proxy(self.source)
+            query = {'api-key': self.key,
+                     'search': query_data,
+                     'page': self.page_num,
+                     'page_size': 100,
+                     'is_web': 1}
+            resp = self.get(self.addr, query)
+            if not resp:
+                return
+            resp_json = resp.json()
+            subdomains = self.match_subdomains(resp)
+            if not subdomains:  # 搜索没有发现子域名则停止搜索
+                break
+            self.subdomains.update(subdomains)
+            total = resp_json.get('data').get('total')
+            if self.page_num * 100 >= int(total):
+                break
+            self.page_num += 1
+
+    def run(self):
+        """
+        类执行入口
+        """
+        if not self.have_api(self.key):
+            return
+        self.begin()
+        self.search()
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def run(domain):
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    search = Hunter(domain)
+    search.run()
+
+
+if __name__ == '__main__':
+    run('freebuf.com')

OneForAll/modules/search/quake_api.py

@@ -0,0 +1,72 @@
+import time
+
+from config import settings
+from common.search import Search
+
+
+class Quake(Search):
+    def __init__(self, domain):
+        Search.__init__(self)
+        self.domain = domain
+        self.module = 'Quake'
+        self.source = "QuakeAPISearch"
+        self.addr = 'https://quake.360.net/api/v3/search/quake_service'
+        self.delay = 1
+        self.key = settings.quake_api_key
+
+    def search(self):
+        """
+        发送搜索请求并做子域匹配
+        """
+        self.per_page_num = 100
+        self.page_num = 0
+        while self.per_page_num * self.page_num < settings.cam_records_maximum_per_domain:
+            time.sleep(self.delay)
+            self.header = self.get_header()
+            self.header.update({'Content-Type': 'application/json'})
+            self.header.update({'X-QuakeToken': self.key})
+            self.proxy = self.get_proxy(self.source)
+
+            query = {'query': 'domain:"' + self.domain + '"',
+                     'start': self.page_num * self.per_page_num,
+                     'size': self.per_page_num,
+                     'include': ["service.http.host"]}
+            resp = self.post(self.addr, json=query)
+            if not resp:
+                return
+            resp_json = resp.json()
+            subdomains = self.match_subdomains(resp)
+            if not subdomains:  # 搜索没有发现子域名则停止搜索
+                break
+            self.subdomains.update(subdomains)
+            total = resp_json.get('meta').get('pagination').get('total')
+            self.page_num += 1
+            if self.page_num * self.per_page_num >= int(total):
+                break
+
+    def run(self):
+        """
+        类执行入口
+        """
+        if not self.have_api(self.key):
+            return
+        self.begin()
+        self.search()
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def run(domain):
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    query = Quake(domain)
+    query.run()
+
+
+if __name__ == '__main__':
+    run('nosugartech.com')

OneForAll/modules/search/shodan_api.py

@@ -0,0 +1,53 @@
+from config import settings
+from common.search import Search
+
+
+class ShodanAPI(Search):
+    def __init__(self, domain):
+        Search.__init__(self)
+        self.domain = domain
+        self.module = 'Search'
+        self.source = 'ShodanAPISearch'
+        self.key = settings.shodan_api_key
+
+    def search(self):
+        """
+        发送搜索请求并做子域匹配
+        """
+        self.header = self.get_header()
+        self.proxy = self.get_proxy(self.source)
+        url = f'https://api.shodan.io/dns/domain/{self.domain}?key={self.key}'
+        resp = self.get(url)
+        if not resp:
+            return
+        data = resp.json()
+        names = data.get('subdomains')
+        subdomain_str = str(set(map(lambda name: f'{name}.{self.domain}', names)))
+        self.subdomains = self.collect_subdomains(subdomain_str)
+
+    def run(self):
+        """
+        类执行入口
+        """
+        if not self.have_api(self.key):
+            return
+        self.begin()
+        self.search()
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def run(domain):
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    search = ShodanAPI(domain)
+    search.run()
+
+
+if __name__ == '__main__':
+    run('freebuf.com')

OneForAll/modules/search/so.py

@@ -0,0 +1,75 @@
+import time
+
+from common.search import Search
+
+
+class So(Search):
+    def __init__(self, domain):
+        Search.__init__(self)
+        self.domain = domain
+        self.module = 'Search'
+        self.source = 'SoSearch'
+        self.addr = 'https://www.so.com/s'
+        self.limit_num = 640  # 限制搜索条数
+        self.per_page_num = 10  # 默认每页显示10页
+
+    def search(self, domain, filtered_subdomain=''):
+        """
+        发送搜索请求并做子域匹配
+
+        :param str domain: 域名
+        :param str filtered_subdomain: 过滤的子域
+        """
+        page_num = 1
+        while True:
+            time.sleep(self.delay)
+            self.header = self.get_header()
+            self.proxy = self.get_proxy(self.source)
+            word = 'site:.' + domain + filtered_subdomain
+            payload = {'q': word, 'pn': page_num}
+            resp = self.get(url=self.addr, params=payload)
+            subdomains = self.match_subdomains(resp, fuzzy=False)
+            if not self.check_subdomains(subdomains):
+                break
+            self.subdomains.update(subdomains)
+            page_num += 1
+            # 搜索页面没有出现下一页时停止搜索
+            if '<a id="snext"' not in resp.text:
+                break
+            # 搜索条数限制
+            if self.page_num * self.per_page_num >= self.limit_num:
+                break
+
+    def run(self):
+        """
+        类执行入口
+        """
+        self.begin()
+        self.search(self.domain)
+
+        # 排除同一子域搜索结果过多的子域以发现新的子域
+        for statement in self.filter(self.domain, self.subdomains):
+            self.search(self.domain, filtered_subdomain=statement)
+
+        # 递归搜索下一层的子域
+        if self.recursive_search:
+            for subdomain in self.recursive_subdomain():
+                self.search(subdomain)
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def run(domain):
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    search = So(domain)
+    search.run()
+
+
+if __name__ == '__main__':
+    run('mi.com')

OneForAll/modules/search/sogou.py

@@ -0,0 +1,72 @@
+from common.search import Search
+
+
+class Sogou(Search):
+    def __init__(self, domain):
+        Search.__init__(self)
+        self.domain = domain
+        self.module = 'Search'
+        self.source = 'SogouSearch'
+        self.addr = 'https://www.sogou.com/web'
+        self.limit_num = 1000  # 限制搜索条数
+
+    def search(self, domain, filtered_subdomain=''):
+        """
+        发送搜索请求并做子域匹配
+
+        :param str domain: 域名
+        :param str filtered_subdomain: 过滤的子域
+        """
+        self.page_num = 1
+        while True:
+            self.header = self.get_header()
+            self.proxy = self.get_proxy(self.source)
+            word = 'site:.' + domain + filtered_subdomain
+            payload = {'query': word, 'page': self.page_num,
+                       "num": self.per_page_num}
+            resp = self.get(self.addr, payload)
+            subdomains = self.match_subdomains(resp, fuzzy=False)
+            if not self.check_subdomains(subdomains):
+                break
+            self.subdomains.update(subdomains)
+            self.page_num += 1
+            # 搜索页面没有出现下一页时停止搜索
+            if '<a id="sogou_next"' not in resp.text:
+                break
+            # 搜索条数限制
+            if self.page_num * self.per_page_num >= self.limit_num:
+                break
+
+    def run(self):
+        """
+        类执行入口
+        """
+        self.begin()
+        self.search(self.domain)
+
+        # 排除同一子域搜索结果过多的子域以发现新的子域
+        for statement in self.filter(self.domain, self.subdomains):
+            self.search(self.domain, filtered_subdomain=statement)
+
+        # 递归搜索下一层的子域
+        if self.recursive_search:
+            for subdomain in self.recursive_subdomain():
+                self.search(subdomain)
+        self.finish()
+        self.save_json()
+        self.gen_result()
+        self.save_db()
+
+
+def run(domain):
+    """
+    类统一调用入口
+
+    :param str domain: 域名
+    """
+    search = Sogou(domain)
+    search.run()
+
+
+if __name__ == '__main__':
+    run('example.com')