-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathscan.py
300 lines (286 loc) · 17.1 KB
/
scan.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
#!/usr/bin/python
# Versão 2 do meu script Admin-Finder
# Versão melhorada
# Coded by Nano
# Telegram: t.me/rdzin9
import os
import sys
import requests
import time
import datetime
import json
from BanerAdm import BanerAdm
from validator import way
SESSIONS = requests.Session()
ENTER_USER = sys.argv
verbose = False
tecnologia = []
servidor_web = []
sizes = 0
numrs_dos_dias = datetime.date.today().weekday()
dias_da_semana = ["Segunda-feira","Terça-feira","Quarta-feira","Quinta-feira","Sexta-feira","Sábado","Domingo"]
if len(ENTER_USER) >= 2 and len(ENTER_USER) <= 6:
try:
if "--v" in sys.argv[5]:
verbose = "sim"
else:
pass
except IndexError:
pass
if "--site" in ENTER_USER:
validar_entrada = way.ValidEnter(msg=sys.argv[2])
if validar_entrada:
site_alvo = sys.argv[2]
if "--tipo" in ENTER_USER:
tipo_busca = sys.argv[4].lower()
if tipo_busca == "admin":
diretorio_save = sys.argv[2].split("/")
BanerAdm()
info = SESSIONS.get(sys.argv[2],timeout=5,verify=True,headers=way.headers)
for head,dados in info.headers.items():
if head == "X-Powered-By":
tecnologia.append(dados)
elif head == "Server":
servidor_web.append(dados)
if info.status_code == 200:
try:
subdominios_paraostestes1 = []
subdominios_encontrados1 = []
subdominios_deletados1 = []
print("\n\n\033[1m>>>>>\033[m \033[1;32mSOBRE O SITE:\033[m \033[1m<<<<<\033[m\n")
if servidor_web:
print("\033[1;32m[\033[m\033[1m*\033[m\033[1;32m]\033[m \033[1;32m[\033[m\033[1mINFO\033[m\033[1;32m]\033[m \033[1mSERVIDOR:\033[m \033[1;34m{}\033[m".format(servidor_web[0]))
else:
print("\033[1;31m[\033[m\033[1m!\033[m\033[1;31m]\033[m \033[1;31m[\033[m\033[1;31mINFO\033[m\033[1;31m]\033[m \033[1mSERVIDOR:\033[m \033[1;31mNenhuma informação encontrada!\033[m")
if tecnologia:
print("\033[1;32m[\033[m\033[1m*\033[m\033[1;32m]\033[m \033[1;32m[\033[m\033[1mINFO\033[m\033[1;32m]\033[m \033[1mTECNOLOGIA:\033[m \033[1;34m{}\033[m".format(tecnologia[0]))
else:
print("\033[1;31m[\033[m\033[1m!\033[m\033[1;31m]\033[m \033[1;31m[\033[m\033[1;31mINFO\033[m\033[1;31m]\033[m \033[1mTECNOLOGIA:\033[m \033[1;31mNenhuma informação encontrada!\033[m")
except:
pass
if sys.platform == "linux":
wordlist_sizes = open("admin.txt","r").readlines()
sizes = len(wordlist_sizes)
else:
with open("admin.txt","rt") as count1:
for diretorio in count1:
subdominios_paraostestes1.append(diretorio.replace("\n",""))
count1.close()
print("\n\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m\033[1m\033[m \033[1mVarredura iniciada no alvo:\033[m \033[1;4;3;31m{}\033[m".format(sys.argv[2]))
if numrs_dos_dias < 5:
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mIniciado na:\033[m \033[1;34m{}\033[m \033[1mas\033[m \033[1;34m{}\033[m".format(dias_da_semana[numrs_dos_dias],datetime.datetime.now().strftime("%H:%M:%S")))
else:
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mIniciado no:\033[m \033[1;34m{}\033[m \033[1mas\033[m \033[1;34m{}\033[m".format(dias_da_semana[numrs_dos_dias],datetime.datetime.now().strftime("%H:%M:%S")))
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mTipo de busca:\033[m \033[1;33m{}\033[m".format(sys.argv[4].replace("admin","Páginas e Diretórios")))
if sys.platform == "linux":
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mTamanho da Wordlist:\033[m \033[1;32m{}\033[m".format(sizes))
else:
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mTamanho da Wordlist:\033[m \033[1;32m{}\033[m".format(len(subdominios_paraostestes1)))
if verbose == "sim":
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mModo verbose:\033[m \033[1;32m{}\033[m\n".format(verbose.replace("sim","True")))
else:
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mModo verbose:\033[m \033[1;31mFalse\033[m\n")
try:
print("\n\033[1;36m>>>>>\033[m \033[1mBUSCANDO PÁGINAS E DIRETÓRIOS\033[m \033[1;36m<<<<<\033[m\n\n")
with open("admin.txt","rt") as admin_search:
for num,adm in enumerate(admin_search):
try:
teste = sys.argv[2]+adm.replace("\n","")
conectar_site = requests.get(teste,timeout=5,verify=True,headers=way.headers)
except KeyboardInterrupt:
print("\n[*] Saindo...")
raise SystemExit
except requests.exceptionsConnectionError:
conectar_site.close()
subdominios_deletados1.append(teste)
continue
except requests.exceptions.SSLError:
conectar_site.close()
subdominios_deletados1.append(teste)
continue
except requests.exceptions.InvalidURL:
conectar_site.close()
subdominios_deletados1.append(teste)
continue
except requests.exceptions.TooManyRedirects:
conectar_site.close()
continue
else:
if conectar_site.status_code == 200:
conectar_site.close()
subdominios_encontrados1.append(teste)
if teste.endswith(".php"):
print("\033[m\033[1m[\033[m\033[1;36m{}\033[m\033[1m]\033[m \033[1m[\033[m\033[1;32m{}\033[m\033[1m]\033[m \033[1;36mArquivo php:\033[m \033[1m{}\033[m".format(datetime.datetime.now().strftime("%H:%M:%S"),conectar_site.status_code,teste))
elif teste.endswith(".xml"):
print("\033[m\033[1m[\033[m\033[1;36m{}\033[m\033[1m]\033[m \033[1m[\033[m\033[1;32m{}\033[m\033[1m]\033[m \033[1;36mMapa do site:\033[m \033[1m{}\033[m".format(datetime.datetime.now().strftime("%H:%M:%S"),conectar_site.status_code,teste))
elif teste.endswith(".txt"):
print("\033[m\033[1m[\033[m\033[1;36m{}\033[m\033[1m]\033[m \033[1m[\033[m\033[1;32m{}\033[m\033[1m]\033[m \033[1;36mArquivo Robots:\033[m \033[1m{}\033[m".format(datetime.datetime.now().strftime("%H:%M:%S"),conectar_site.status_code,teste))
else:
print("\033[m\033[1m[\033[m\033[1;36m{}\033[m\033[1m]\033[m \033[1m[\033[m\033[1;32m{}\033[m\033[1m]\033[m \033[1;36mDiretório:\033[m \033[1m{}\033[m".format(datetime.datetime.now().strftime("%H:%M:%S"),conectar_site.status_code,teste))
if sys.platform == "win32":
os.makedirs(diretorio_save[2],exist_ok=True)
with open(str(os.getcwd())+str(r"\\"+diretorio_save[2])+r"\\"+"Diretórios-de-"+diretorio_save[2]+".txt","a") as save1:
save1.write("--------------------------------------\n")
save1.write("URL ENCONTRADA: {}\n".format(teste))
save1.write("--------------------------------------\n")
save1.close()
if sys.platform == "linux":
os.makedirs(diretorio_save[2],exist_ok=True)
with open(str(os.getcwd())+str("/"+diretorio_save[2])+"/"+"Diretórios-de-"+diretorio_save[2]+".txt","a") as save2:
save2.write("--------------------------------------\n")
save2.write("URL ENCONTRADA: {}\n".format(teste))
save2.write("--------------------------------------\n")
save2.close()
else:
conectar_site.close()
subdominios_deletados1.append(teste)
if "--v" in ENTER_USER:
print("\033[m\033[1m[\033[m\033[1;36m{}\033[m\033[1m]\033[m \033[1m[\033[m\033[1;31m{}\033[m\033[1m]\033[m \033[1;31mTested:\033[m \033[3;2m{}\033[m".format(datetime.datetime.now().strftime("%H:%M:%S"),conectar_site.status_code,teste))
else:
pass
admin_search.close()
print("\n\033[1m >>>>>>\033[m \033[1;32mDETALHES DOS TESTES\033[m \033[1m<<<<<<\033[m\n")
print("\033[1mSubdomínios testados:\033[m \033[1m[\033[m \033[1;33m{}\033[m \033[1m]\033[m | \033[1m Subdomínios encontrados:\033[m \033[1m[\033[m \033[1;32m{}\033[m \033[1m]\033[m | \033[1m Subdomínios descartados:\033[m \033[1m[\033[m \033[1;31m{}\033[m \033[1m]\033[m\n\n".format(len(subdominios_paraostestes1),len(subdominios_encontrados1),len(subdominios_deletados1)))
except:
pass
elif tipo_busca == "sublinks":
diretorio_save = sys.argv[2].split("/")
subdominios_paraostestes = []
subdominios_encontrados = []
subdominios_deletados = []
diretorio_save2 = sys.argv[2].split("/")
info2 = SESSIONS.get(sys.argv[2],timeout=5,verify=True,headers=way.headers)
for head,dados in info2.headers.items():
if head == "X-Powered-By":
tecnologia.append(dados)
elif head == "Server":
servidor_web.append(dados)
try:
with open("Subdominios.txt","rt") as count:
for subs in count:
subdominios_paraostestes.append(subs.replace("\n",""))
count.close()
except FileNotFoundError:
BanerAdm()
print("\033[1m[\033[m\033[1;31m!\033[m\033[1m]\033[m Wordlist não encontrada!")
raise SystemExit
BanerAdm()
if info2.status_code == 200:
try:
print("\n\n\033[1m>>>>>\033[m \033[1;32mSOBRE O SITE:\033[m \033[1m<<<<<\033[m\n")
if servidor_web:
print("\033[1;32m[\033[m\033[1m*\033[m\033[1;32m]\033[m \033[1;32m[\033[m\033[1mINFO\033[m\033[1;32m]\033[m \033[1mSERVIDOR:\033[m \033[1;34m{}\033[m".format(servidor_web[0]))
else:
print("\033[1;31m[\033[m\033[1m!\033[m\033[1;31m]\033[m \033[1;31m[\033[m\033[1;31mINFO\033[m\033[1;31m]\033[m \033[1mSERVIDOR:\033[m \033[1;31mNenhuma informação encontrada!\033[m")
if tecnologia:
print("\033[1;32m[\033[m\033[1m*\033[m\033[1;32m]\033[m \033[1;32m[\033[m\033[1mINFO\033[m\033[1;32m]\033[m \033[1mTECNOLOGIA:\033[m \033[1;34m{}\033[m".format(tecnologia[0]))
else:
print("\033[1;31m[\033[m\033[1m!\033[m\033[1;31m]\033[m \033[1;31m[\033[m\033[1;31mINFO\033[m\033[1;31m]\033[m \033[1mTECNOLOGIA:\033[m \033[1;31mNenhuma informação encontrada!\033[m")
except:
pass
print("\n\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m\033[1m\033[m \033[1mVarredura iniciada no alvo:\033[m \033[1;4;3;31m{}\033[m".format(sys.argv[2]))
if numrs_dos_dias < 5:
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mIniciado na:\033[m \033[1;34m{}\033[m \033[1mas\033[m \033[1;34m{}\033[m".format(dias_da_semana[numrs_dos_dias],datetime.datetime.now().strftime("%H:%M:%S")))
else:
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mIniciado no:\033[m \033[1;34m{}\033[m \033[1mas\033[m \033[1;34m{}\033[m".format(dias_da_semana[numrs_dos_dias],datetime.datetime.now().strftime("%H:%M:%S")))
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mTipo de busca:\033[m \033[1;33m{}\033[m".format(sys.argv[4].replace("sublinks","subdomínios")))
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mEssa parte pode\033[m \033[1m(\033[m\033[1;31mdemorar\033[m\033[1m)\033[m\033[1m:\033[m")
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mTamanho da Wordlist:\033[m \033[1;32m{}\033[m".format(len(subdominios_paraostestes)))
if verbose == "sim":
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mModo verbose:\033[m \033[1;32m{}\033[m\n".format(verbose.replace("sim","True")))
else:
print("\033[1;36m[\033[m\033[1m+\033[m\033[1;36m]\033[m \033[1mModo verbose:\033[m \033[1;31mFalse\033[m\n")
try:
print("\n\033[1;36m>>>>>\033[m \033[1mBUSCANDO SUBDOMÍNIOS\033[m \033[1;36m<<<<<\033[m\n\n")
url1 = sys.argv[2].split("/")
with open("Subdominios.txt","rt") as admin_search2:
for num2,adm2 in enumerate(admin_search2):
try:
try:
url2 = url1[2].replace("www.","")
except:
pass
url3 = url1[0]+"//"+adm2.replace("\n","")+"."+url2
conectar_site2 = requests.get(url3,timeout=5,verify=True,headers=way.headers)
except KeyboardInterrupt:
print("\n[*] Saindo...")
raise SystemExit
except requests.exceptions.ConnectionError:
subdominios_deletados.append(url3)
continue
except requests.exceptions.SSLError:
subdominios_deletados.append(url3)
continue
except requests.exceptions.InvalidURL:
subdominios_deletados.append(url3)
continue
except requests.exceptions.TooManyRedirects:
continue
else:
if conectar_site2.status_code == 200:
conectar_site2.close()
print("\033[m\033[1m[\033[m\033[1;36m{}\033[m\033[1m]\033[m \033[1m[\033[m\033[1;32m{}\033[m\033[1m]\033[m \033[1;36mSubdomínio:\033[m \033[1m{}\033[m".format(datetime.datetime.now().strftime("%H:%M:%S"),conectar_site2.status_code,url3))
subdominios_encontrados.append(url3)
if sys.platform == "win32":
os.makedirs(diretorio_save[2],exist_ok=True)
with open(str(os.getcwd())+str(r"\\"+diretorio_save[2])+r"\\"+"Subdomios-de-"+diretorio_save[2]+".txt","a") as save1:
save1.write("--------------------------------------\n")
save1.write("URL ENCONTRADA: {}\n".format(url3))
save1.write("--------------------------------------\n")
save1.close()
if sys.platform == "linux":
os.makedirs(diretorio_save[2],exist_ok=True)
with open(str(os.getcwd())+str("/"+diretorio_save[2])+"/"+"Subdomios-de-"+diretorio_save[2]+".txt","a") as save2:
save2.write("--------------------------------------\n")
save2.write("URL ENCONTRADA: {}\n".format(url3))
save2.write("--------------------------------------\n")
save2.close()
else:
conectar_site2.close()
subdominios_deletados.append(url3)
if verbose == "sim":
print("\033[m\033[1m[\033[m\033[1;36m{}\033[m\033[1m]\033[m \033[1m[\033[m\033[1;31m{}\033[m\033[1m]\033[m \033[1;31mTested:\033[m \033[3;2m{}\033[m".format(datetime.datetime.now().strftime("%H:%M:%S"),conectar_site2.status_code,url3))
else:
pass
admin_search2.close()
print("\n\033[1m >>>>>>\033[m \033[1;32mDETALHES DOS TESTES\033[m \033[1m<<<<<<\033[m\n")
print("\033[1mSubdomínios testados:\033[m \033[1m[\033[m \033[1;33m{}\033[m \033[1m]\033[m | \033[1m Subdomínios encontrados:\033[m \033[1m[\033[m \033[1;32m{}\033[m \033[1m]\033[m | \033[1m Subdomínios descartados:\033[m \033[1m[\033[m \033[1;31m{}\033[m \033[1m]\033[m\n\n".format(len(subdominios_paraostestes),len(subdominios_encontrados),len(subdominios_deletados)))
except FileNotFoundError:
BanerAdm()
print("\033[1m[\033[m\033[1;31m!\033[m\033[1m]\033[m Wordlist não encontrada!")
raise SystemExit
except KeyboardInterrupt:
print("[+] Saindo...")
raise SystemExit
else:
BanerAdm()
print("Verifique a url digitada, protocolo (http ou https) e no final da url adicione uma /")
elif "--help" in ENTER_USER[1]:
BanerAdm()
print("\033[1;36m\n\n#############\033[m \033[1mBEM VINDO AO MENU DE HELP\033[m \033[1;36m#############\033[m")
print("\033[1;32m\n\n------------ TIPOS DE URL SUPORTADAS ------------\033[m\n\n")
print("suportada as urls HTTP:// E HTTPS://")
print("Não se esqueça de colocar a url com o protocolo\n\n")
print("\033[1;33m\n------------ LINHAS DE COMANDOS ------------\033[m\n\n")
print("{} --site http://bancocn.com/ --tipo admin".format(sys.argv[0]))
print("{} --site http://bancocn.com/ --tipo sublinks\n".format(sys.argv[0]))
print("\033[1;32m\n\n------------ TIPOS DE COMANDOS DISPONÍVEIS ------------\033[m\n\n")
print("\n{} --help : Usado para chamar o painel de ajuda!".format(sys.argv[0]))
print("{} --site : Usado para especificar um site alvo!".format(sys.argv[0]))
print("{} --tipo : Usado para especificar o tipo de wordlist a ser usada!".format(sys.argv[0]))
print("{} --v : Usado para mostrar as saídas das url's que deram erro! \n".format(sys.argv[0]))
print("\033[1;32m\n\n------------ TIPOS DE WORDLISTS DISPONÍVEIS ------------\033[m\n\n")
print("Wordlist 1 -> Usada para achar paineis de Admin")
print("Wordlist 2 -> Usada para achar subdomínios do site alvo\n")
print("\033[1;32m\n\n------------ USANDO AS WORDLISTS DISPONÍVEIS ------------\033[m\n\n")
print("{} --site SITE AQUI --tipo admin : Usado para especificar que será usada a wordlist de diretório Admin!".format(sys.argv[0]))
print("{} --site SITE AQUI --tipo sublinks : Usado para especificar que será usada a wordlist de sublinks para encontrar outros domínios!".format(sys.argv[0]))
print("{} --site SITE AQUI --tipo admin --v : Usado para especificar que será usada a wordlist de diretório Admin! (com verbose)".format(sys.argv[0]))
print("{} --site SITE AQUI --tipo sublinks --v : Usado para especificar que será usada a wordlist de sublinks para encontrar outros domínios! (com verbose)\n".format(sys.argv[0]))
print("\033[1;32m\n\n------------ ARMAZENAMENTO DAS SÁIDAS DO SCRIPT ------------\033[m\n\n")
print("Todas as saídas da URL de admin, serão armazenadas dentro das pastas com o nome do site que foi feito o scan!")
print("Sempre que o script encontrar uma página, ele cria uma pasta com o nome do site e armazena a saída dentro do arquivo Found.txt!\n\n")
else:
BanerAdm()
print("\n\033[1m[\033[m\033[1;31m!\033[m\033[1m]\033[m \033[1m Digite: {} --help para saber como funciona!\n".format(sys.argv[0]))
#end