nahamsec/hostilesubbruteforcerHerramienta de fuerza bruta de subdominios que enumera subdominios existentes y detecta subdominios alojados en la nube mal configurados y vulnerables a la toma de control en AWS, GitHub, Heroku, Shopify, Tumblr y Squarespace.
Esta aplicación realizará un ataque de fuerza bruta para encontrar subdominios existentes y proporcionará la siguiente información:
Puede haber algunos falsos positivos dependiendo de las configuraciones del host. (Se intentó eliminarlos tanto como sea posible) También funciona de forma recursiva al final para obtener los subdominios debajo de los que ya ha encontrado y vuelca todos tus datos en un archivo output.txt por si acaso (se crea uno nuevo al inicio de cada proceso)
##Más información http://labs.detectify.com/post/109964122636/hostile-subdomain-takeover-using
##Ejemplo de salida
Enter a domain you'd like to brute force and look for hostile subdomain takeover(example: yahoo.com)
example.com
200 0.example.com ---> 198.185.159.177
- Subdomain pointing to a non-existing SquareSpace account showing: No Such Account
- Seems like 0.example.com is an alias for exampledomain111.squarespace.com
404 a.example.com ---> 50.116.58.222
- Subdomain pointing to a non-existing WPEngine subdomain indicatingThe site you were looking for couldn't be found.
- Seems like a.example.com is an alias for exampledomain111.wpengine.com
----> Check for further information on where this is pointing to.
404 b.example.com ---> 54.231.18.81
- Subdomain pointing to an unclaimed AmazonAWS bucket showing: NoSuchBucket
- Seems like b.example.com is an alias for exampledomain111.images.s3.amazonaws.com
----> Check for further information on where this is pointing to.
404 c.example.com ---> 23.227.38.70
- Subdomain pointing to a non-existing Shopify subdomain indicatingSorry, this shop is currently unavailable.
- Seems like c.example.com is an alias for theresnosuchdomain.myshopify.com
----> Check for further information on where this is pointing to.
301 cpanel.example.com ---> 1.1.1.1
404 e.example.com ---> 23.235.47.133
- Subdomain pointing to a non-existing Github subdomain indicatingThere isn't a GitHub Pages site here
- Seems like e.example.com is an alias for noneexistingexampledomain.github.com
----> Check for further information on where this is pointing to.
404 f.example.com ---> 199.27.79.133
- Subdomain pointing to a non-existing Github subdomain indicatingThere isn't a GitHub Pages site here
- Seems like f.example.com is an alias for noneexistingexampledomain.github.io
----> Check for further information on where this is pointing to.
200 ftp.example.com ---> 1.1.1.1
200 g.example.com ---> 104.238.181.195
- Seems like g.example.com is an alias for somedomain.anotherexample.com
Este modo utiliza múltiples hilos para producir resultados más rápido. Actualmente la salida no está sincronizada.
Para ejecutar este modo usa --fast como argumento.
ruby sub_brute.rb --fast
¡Buena suerte!