YYiGdzk7

1from recon.core.module import BaseModule
2from cookielib import CookieJar
3import urllib
4import re
5import time
6import random
7
8class Module(BaseModule):
9
10    meta = {
11        'name': 'Bing Hostname Enumerator',
12        'author': 'Tim Tomes (@LaNMaSteR53)',
13        'description': 'Harvests hosts from Bing.com by using the \'site\' search operator. Updates the \'hosts\' table with the results.',
14        'query': 'SELECT DISTINCT domain FROM domains WHERE domain IS NOT NULL',
15        'options': (
16            ('limit', None, 1, 'How many domains to query'),
17        ),
18    }
19
20    def module_run(self, domains):
21        base_url = 'https://www.bing.com/search'
22        for domain in domains:
23            no_of_domains = 0
24            self.heading(domain, level=0)
25            base_query = domain
26#            base_query = 'domain:' + domain
27            pattern = '"b_algo"><h2><a href="(?:\w*://)*(\S+?)\.%s[^"]*"' % ("au")
28            subs = []
29            # control variables
30            new = True
31            page = 0
32            nr = 50
33            cookiejar = CookieJar()
34            cookiejar.set_cookie(self.make_cookie('SRCHHPGUSR', 'NEWWND=0&NRSLT=%d&SRCHLANG=&AS=1' % (nr), '.bing.com'))
35            # execute search engine queries and scrape results storing subdomains in a list
36            # loop until no new subdomains are found
37            while new == True:
38                content = None
39                query = ''
40                full_query = base_query + query
41                url = '%s?first=%d&q=%s' % (base_url, (page*nr), urllib.quote_plus(full_query))
42                # bing errors out at > 2059 characters not including the protocol
43                if len(url) > 2066: url = url[:2066]
44                self.verbose('URL: %s' % (url))
45                # send query to search engine
46                resp = self.request(url, cookiejar=cookiejar)
47                if resp.status_code != 200:
48                    self.alert('Bing has encountered an error. Please submit an issue for debugging.')
49                    break
50                content = resp.text
51                sites = re.findall(pattern, content)
52                # create a unique list
53                sites = list(set(sites))
54                new = False
55                # add subdomain to list if not already exists
56                for site in sites:
57                    if site not in subs:
58                        subs.append(site)
59                        new = True
60                        host = '%s' % (site)
61                        self.add_hosts(host)
62                        if len(subs) >= self.options['limit']:
63                            break
64                if len(subs) >= self.options['limit']:
65                    break	
66
67                if not new:
68                    # exit if all subdomains have been found
69                    if not '>Next</a>' in content:
70                        break
71                    else:
72                        page += 1
73                        self.verbose('No New Subdomains Found on the Current Page. Jumping to Result %d.' % ((page*nr)+1))
74                        new = True
75                # sleep script to avoid lock-out
76                self.verbose('Sleeping to avoid lockout...')
77                time.sleep(random.randint(5,15))