InstaRecon

Reconnaissance numérique de base automatisée. Idéal pour obtenir une première empreinte de vos cibles et découvrir des sous-domaines supplémentaires. InstaRecon effectuera :

• Requêtes DNS (A, PTR, MX, NS)
• Requêtes DNS récursives sur tous les hôtes découverts
• Requêtes Whois (sur le domaine et l'IP)
• Google dorks recherchant des sous-domaines et des URLs
• Requêtes Shodan
• Requêtes DNS inverses sur des CIDR entiers (uniquement si la cible est un réseau)

...le tout imprimé proprement sur votre console ou dans un fichier csv.

InstaRecon ne scannera jamais une cible directement. Les informations sont récupérées depuis les serveurs DNS/Whois, Google, et Shodan.

Installing

Pour installer, faites simplement :```bash pip install -r requirements.txt

Les dépendances devraient être automatiquement installées. Ensuite, allez :```bash 
instarecon.py <target>

Testé sur Ubuntu 14.04 et Kali-Rolling (2016.1).

TODO

• robots.txt de Shodan
• Améliorer les fichiers de sortie - utiliser xlsx au lieu de csv, car la largeur peut être contrôlée.
• Améliorer les performances du crawler Google, implémenter des en-têtes et user-agents aléatoires.
• Threading du scan.
• Scraping des pages LinkedIn. Éventuellement d'autres sources ?
• Installable via pip ? (https://packaging.python.org/en/latest/distributing.html).
• Permettre de définir les paramètres de proxy.

Example```bash

$ instarecon.py -v -s <shodan_key> -o ~/github.com.csv github.com

InstaRecon v0.1.2 - by Luis Teixeira (teix.co)

Scanning 1/1 hosts

Shodan key provided - <shodan_key>

____________________ Scanning github.com ____________________

DNS lookups

[*] Domain: github.com

[*] IPs & reverse DNS: 192.30.252.129 - github.com

[*] NS records: ns4.p16.dynect.net 204.13.251.16 - ns4.p16.dynect.net ns3.p16.dynect.net 208.78.71.16 - ns3.p16.dynect.net ns2.p16.dynect.net 204.13.250.16 - ns2.p16.dynect.net ns1.p16.dynect.net 208.78.70.16 - ns1.p16.dynect.net

[*] MX records: ASPMX.L.GOOGLE.com 74.125.203.26 - th-in-f26.1e100.net ALT2.ASPMX.L.GOOGLE.com 64.233.168.26 - oj-in-f26.1e100.net ALT3.ASPMX.L.GOOGLE.com 173.194.219.27 - ya-in-f27.1e100.net ALT4.ASPMX.L.GOOGLE.com 173.194.219.27 - ya-in-f27.1e100.net ALT1.ASPMX.L.GOOGLE.com 74.125.25.27 - pa-in-f27.1e100.net

Whois lookups

[*] Whois domain: Domain Name: github.com Registry Domain ID: 1264983250_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.markmonitor.com Registrar URL: http://www.markmonitor.com Updated Date: 2015-01-08T04:00:18-0800 Creation Date: 2007-10-09T11:20:50-0700 Registrar Registration Expiration Date: 2020-10-09T11:20:50-0700 Registrar: MarkMonitor, Inc. Registrar IANA ID: 292 Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: +1.2083895740 Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited) Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited) Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited) Registry Registrant ID: Registrant Name: GitHub Hostmaster Registrant Organization: GitHub, Inc. Registrant Street: 88 Colin P Kelly Jr St, Registrant City: San Francisco Registrant State/Province: CA Registrant Postal Code: 94107 Registrant Country: US Registrant Phone: +1.4157354488 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: [email protected] Registry Admin ID: Admin Name: GitHub Hostmaster Admin Organization: GitHub, Inc. Admin Street: 88 Colin P Kelly Jr St, Admin City: San Francisco Admin State/Province: CA Admin Postal Code: 94107 Admin Country: US Admin Phone: +1.4157354488 Admin Phone Ext: Admin Fax: Admin Fax Ext: Admin Email: [email protected] Registry Tech ID: Tech Name: GitHub Hostmaster Tech Organization: GitHub, Inc. Tech Street: 88 Colin P Kelly Jr St, Tech City: San Francisco Tech State/Province: CA Tech Postal Code: 94107 Tech Country: US Tech Phone: +1.4157354488 Tech Phone Ext: Tech Fax: Tech Fax Ext: Tech Email: [email protected] Name Server: ns2.p16.dynect.net Name Server: ns1.p16.dynect.net Name Server: ns4.p16.dynect.net Name Server: ns3.p16.dynect.net DNSSEC: unsigned URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

Last update of WHOIS database: 2015-06-17T19:49:18-0700

[*] Whois IP for 192.30.252.129: asn: 36459 asn_cidr: 192.30.252.0/24 asn_country_code: US asn_date: 2012-11-15 asn_registry: arin net 0: cidr: 192.30.252.0/22 range: 192.30.252.0 - 192.30.255.255 name: GITHUB-NET4-1 description: GitHub, Inc. handle: NET-192-30-252-0-1

address: 88 Colin P Kelly Jr Street
city: San Francisco
state: CA
postal_code: 94107
country: US

abuse_emails: [email protected]
tech_emails: [email protected]

created: 2012-11-15 00:00:00
updated: 2013-01-05 00:00:00

Querying Shodan for open ports

[*] Shodan: IP: 192.30.252.129 Organization: GitHub ISP: GitHub

Port: 80 Banner: HTTP/1.1 301 Moved Permanently Content-length: 0 Location: https://192.30.252.129/ Connection: close Port: 22 Banner: SSH-2.0-libssh-0.6.0 Key type: ssh-rsa Key: AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PH kccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETY P81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoW f9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lG HSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== Fingerprint: 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48