InstaRecon

Reconhecimento digital básico automatizado. Ótimo para obter uma pegada inicial dos seus alvos e descobrir subdomínios adicionais. InstaRecon irá fazer:

• Consultas DNS (A, PTR, MX, NS)
• Consultas DNS recursivas em todos os hosts descobertos
• Consultas Whois (no domínio e no IP)
• Dorks do Google procurando por subdomínios e URLs
• Consultas Shodan
• Consultas DNS reversas em CIDRs inteiros (apenas se o alvo for uma rede)

...tudo impresso de forma agradável no seu console ou arquivo csv.

InstaRecon nunca irá escanear um alvo diretamente. As informações são recuperadas de servidores DNS/Whois, Google e Shodan.

Instalação

Para instalar, basta fazer:```bash pip install -r requirements.txt

As dependências devem ser instaladas automaticamente. Então vá:```bash 
instarecon.py <target>

Testado no Ubuntu 14.04 e Kali-Rolling (2016.1).

A FAZER

• Shodan robots.txt
• Melhorar arquivos de saída - usar xlsx em vez de csv, pois a largura pode ser controlada.
• Melhorar o desempenho do crawler do Google, implementar cabeçalhos e user-agents aleatórios.
• Threading da varredura.
• Raspagem de páginas do LinkedIn. Possivelmente outras fontes?
• Instalável via pip? (https://packaging.python.org/en/latest/distributing.html).
• Permitir que configurações de proxy sejam definidas.

Exemplo```bash

$ instarecon.py -v -s <shodan_key> -o ~/github.com.csv github.com

InstaRecon v0.1.2 - by Luis Teixeira (teix.co)

Scanning 1/1 hosts

Shodan key provided - <shodan_key>

____________________ Scanning github.com ____________________

DNS lookups

[*] Domain: github.com

[*] IPs & reverse DNS: 192.30.252.129 - github.com

[*] NS records: ns4.p16.dynect.net 204.13.251.16 - ns4.p16.dynect.net ns3.p16.dynect.net 208.78.71.16 - ns3.p16.dynect.net ns2.p16.dynect.net 204.13.250.16 - ns2.p16.dynect.net ns1.p16.dynect.net 208.78.70.16 - ns1.p16.dynect.net

[*] MX records: ASPMX.L.GOOGLE.com 74.125.203.26 - th-in-f26.1e100.net ALT2.ASPMX.L.GOOGLE.com 64.233.168.26 - oj-in-f26.1e100.net ALT3.ASPMX.L.GOOGLE.com 173.194.219.27 - ya-in-f27.1e100.net ALT4.ASPMX.L.GOOGLE.com 173.194.219.27 - ya-in-f27.1e100.net ALT1.ASPMX.L.GOOGLE.com 74.125.25.27 - pa-in-f27.1e100.net

Whois lookups

[*] Whois domain: Domain Name: github.com Registry Domain ID: 1264983250_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.markmonitor.com Registrar URL: http://www.markmonitor.com Updated Date: 2015-01-08T04:00:18-0800 Creation Date: 2007-10-09T11:20:50-0700 Registrar Registration Expiration Date: 2020-10-09T11:20:50-0700 Registrar: MarkMonitor, Inc. Registrar IANA ID: 292 Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: +1.2083895740 Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited) Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited) Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited) Registry Registrant ID: Registrant Name: GitHub Hostmaster Registrant Organization: GitHub, Inc. Registrant Street: 88 Colin P Kelly Jr St, Registrant City: San Francisco Registrant State/Province: CA Registrant Postal Code: 94107 Registrant Country: US Registrant Phone: +1.4157354488 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: [email protected] Registry Admin ID: Admin Name: GitHub Hostmaster Admin Organization: GitHub, Inc. Admin Street: 88 Colin P Kelly Jr St, Admin City: San Francisco Admin State/Province: CA Admin Postal Code: 94107 Admin Country: US Admin Phone: +1.4157354488 Admin Phone Ext: Admin Fax: Admin Fax Ext: Admin Email: [email protected] Registry Tech ID: Tech Name: GitHub Hostmaster Tech Organization: GitHub, Inc. Tech Street: 88 Colin P Kelly Jr St, Tech City: San Francisco Tech State/Province: CA Tech Postal Code: 94107 Tech Country: US Tech Phone: +1.4157354488 Tech Phone Ext: Tech Fax: Tech Fax Ext: Tech Email: [email protected] Name Server: ns2.p16.dynect.net Name Server: ns1.p16.dynect.net Name Server: ns4.p16.dynect.net Name Server: ns3.p16.dynect.net DNSSEC: unsigned URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

Last update of WHOIS database: 2015-06-17T19:49:18-0700

[*] Whois IP for 192.30.252.129: asn: 36459 asn_cidr: 192.30.252.0/24 asn_country_code: US asn_date: 2012-11-15 asn_registry: arin net 0: cidr: 192.30.252.0/22 range: 192.30.252.0 - 192.30.255.255 name: GITHUB-NET4-1 description: GitHub, Inc. handle: NET-192-30-252-0-1

address: 88 Colin P Kelly Jr Street
city: San Francisco
state: CA
postal_code: 94107
country: US

abuse_emails: [email protected]
tech_emails: [email protected]

created: 2012-11-15 00:00:00
updated: 2013-01-05 00:00:00

Querying Shodan for open ports

[*] Shodan: IP: 192.30.252.129 Organization: GitHub ISP: GitHub

Port: 80 Banner: HTTP/1.1 301 Moved Permanently Content-length: 0 Location: https://192.30.252.129/ Connection: close Port: 22 Banner: SSH-2.0-libssh-0.6.0 Key type: ssh-rsa Key: AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PH kccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETY P81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoW f9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lG HSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== Fingerprint: 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48