Anubis

Coverage

        d8888                   888      d8b
       d88888                   888      Y8P
      d88P888                   888
     d88P 888 88888b.  888  888 88888b.  888 .d8888b
    d88P  888 888 "88b 888  888 888 "88b 888 88K
   d88P   888 888  888 888  888 888  888 888 "Y8888b.
  d8888888888 888  888 Y88b 888 888 d88P 888      X88
 d88P     888 888  888  "Y88888 88888P"  888  88888P'

Anubis 是一款子域名枚举和信息收集工具。Anubis 会从多种来源汇总数据，包括 HackerTarget、x509 证书、VirusTotal、Google、Pkey、Shodan、Spyse 和 NetCraft。 Anubis 还有一个姊妹项目 AnubisDB，它作为一个集中式的子域名存储库。

原始 Medium 文章发布

快速开始

先决条件

Nmap（如果需要运行端口扫描和某些证书扫描）

如果你运行的是 Linux，还需要以下内容：

sudo apt-get install python3-pip python3-dev libssl-dev libffi-dev

安装

注意：需要 Python 3.10 或更高版本

pip3 install anubis-netsec

从源码安装

请注意 Anubis 仍处于测试阶段。

git clone https://github.com/jonluca/Anubis.git
cd Anubis
pip3 install  -r requirements.txt
pip3 install .

用法

Usage:
  anubis (-t TARGET | -f FILE) [-o FILENAME]  [-bdinoprsSv] [-w SCAN] [-q NUM]
  anubis -h
  anubis (--version | -V)
  
Options:
  -h --help                       show this help message and exit
  -t --target                     set target (comma separated, no spaces, if multiple)
  -f --file                       set target (reads from file, one domain per line)
  -n --with-nmap                  perform an nmap service/script scan
  -o --output                     save to filename
  -i --additional-info            show additional information about the host from Shodan (requires API key)
  -p --ip                         outputs the resolved IPs for each subdomain, and a full list of unique ips
  -d --send-to-anubis-db          send results to Anubis-DB
  -r --recursive                  recursively search over all subdomains
  -s --ssl                        run an ssl scan and output cipher + chain info
  -S --silent                     only out put subdomains, one per line
  -w --overwrite-nmap-scan SCAN   overwrite default nmap scan (default -nPn -sV -sC)
  -v --verbose                    print debug info and full request output
  -q --queue-workers NUM          override number of queue workers (default: 10, max: 100)
  -V --version                       show version and exit

Help:
  For help using this tool, please open an issue on the Github repository:
  https://github.com/jonluca/anubis

注意：如果你想使用 shodan.io API，请确保在命令前加上 SHODAN_API_KEY=yourkey

基础

常见用例

anubis -tip domain.com -o out.txt

将目标设置为 domain.com（t），输出附加信息（i），如服务器和 ISP 或服务器托管提供商，然后尝试解析所有 URL（p）并输出唯一 IP 列表，同时发送到 Anubis-DB（a）。最后，将所有结果写入 out.txt（o）。

其他

anubis -t reddit.com Anubis 的最简单用法，仅运行子域名枚举

Searching for subdomains for 151.101.65.140 (reddit.com)

Testing for zone transfers
Searching for Subject Alt Names
Searching HackerTarget
Searching VirusTotal
Searching Pkey.in
Searching NetCraft.com
Searching crt.sh
Searching Anubis-DB
Found 193 subdomains
----------------
fj.reddit.com
se.reddit.com
gateway.reddit.com
beta.reddit.com
ww.reddit.com
... (truncated for readability)
Sending to AnubisDB
Subdomain search took 0:00:20.390

anubis -t reddit.com -ip（等同于 anubis -t reddit.com --additional-info --ip）- 解析 IP 并输出唯一列表，并通过 https://shodan.io 提供附加信息

Searching for subdomains for 151.101.65.140
Server Location: San Francisco US - 94107
ISP: Fastly
Found 27 domains
----------------
http://www.np.reddit.com: 151.101.193.140
http://nm.reddit.com: 151.101.193.140
http://ww.reddit.com: 151.101.193.140
http://dg.reddit.com: 151.101.193.140
http://en.reddit.com: 151.101.193.140
http://ads.reddit.com: 151.101.193.140
http://zz.reddit.com: 151.101.193.140
out.reddit.com: 107.23.11.190
origin.reddit.com: 54.172.97.226
http://blog.reddit.com: 151.101.193.140
alb.reddit.com: 52.201.172.48
http://m.reddit.com: 151.101.193.140
http://rr.reddit.com: 151.101.193.140
reddit.com: 151.101.65.140
http://www.reddit.com: 151.101.193.140
mx03.reddit.com: 151.101.193.140
http://fr.reddit.com: 151.101.193.140
rhs.reddit.com: 54.172.97.229
http://np.reddit.com: 151.101.193.140
http://nj.reddit.com: 151.101.193.140
http://re.reddit.com: 151.101.193.140
http://iy.reddit.com: 151.101.193.140
mx02.reddit.com: 151.101.193.140
mailp236.reddit.com: 151.101.193.140
Found 6 unique IPs
52.201.172.48
151.101.193.140
107.23.11.190
151.101.65.140
54.172.97.226
54.172.97.229
Execution took 0:00:04.604

高级

anubis -t reddit.com --with-nmap -o temp.txt -i --overwrite-nmap-scan "-F -T5"

Searching for subdomains for 151.101.65.140 (reddit.com)

Testing for zone transfers
Searching for Subject Alt Names
Searching HackerTarget
Searching VirusTotal
Searching Pkey.in
Searching NetCraft.com
Searching crt.sh
Searching Anubis-DB
Searching Shodan.io for additional information
Server Location: San Francisco, US - 94107
ISP  or Hosting Company: Fastly
To run a DNSSEC subdomain enumeration, Anubis must be run as root
Starting Nmap Scan
Host : 151.101.65.140 ()
----------
Protocol: tcp
port: 80	state: open
port: 443	state: open
Found 195 subdomains
----------------
nm.reddit.com
ne.reddit.com
sonics.reddit.com
aj.reddit.com
fo.reddit.com
f5.reddit.com
... (truncated for readability)
Sending to AnubisDB
Subdomain search took 0:00:26.579

运行测试

在原生 pytest 环境中单独运行测试

pytest

构建工具

CLI 样板由 Skele-CLI 提供

贡献

请阅读 CONTRIBUTING.md 以了解我们的行为准则以及向我们提交拉取请求的流程。

作者

JonLuca DeCaro - 初始工作 - Anubis

另请参阅参与此项目的贡献者列表。

许可证

本项目根据 MIT 许可证授权 - 详情请参阅 LICENSE.md 文件

anubis

最受欢迎