使用C#winform編寫滲透測試工具--子域名挖掘

這篇文章主要介紹使用C#winform編寫滲透測試工具--子域名挖掘。在滲透測試中，子域名的收集十分重要，通常一個網站的主站的防禦能力特別強，而他們的非主站相對較弱，我們便可以通過收集子站資訊從而擴大攻擊範圍，增大滲透的可能。

  • 下面是使用C#winform編寫的滲透測試工具，前面我們已經完成了埠掃描、敏感目錄掃描和暴力破解的工作，這一部分將介紹如何實現子域名挖掘。

目錄

  1. 各種子域名挖掘技術
  2. 程式碼實現
  3. 使用步驟

一、各種子域名挖掘技術

字典爆破

  • 字典爆破就是通過收集來的字典，拼接到頂級域名前面，然後通過自動化工具進行訪問，判斷返回結果，從而跑出子域名是否存在。比如ESD，subDomainsBrute。

證書SSL查詢

  • 因為SSL證書支援證書透明度，而SSL裡包含子域名。證書SSL查詢就是通過HTTPS 證書，ssl證書等蒐集子域名記錄。比如網站cet就是從SSL證書收集子域名。

DNS資料

  • DNS原理就是蒐集DNS的解析歷史，通過查詢dns記錄來獲取到對方的解析記錄，從而獲取到子域名，正常來說你的域名經DNS解析過一般就會搜到。比如virustotal執行DNS解析來構建資料庫，來檢索子域名。

爬蟲提取子域名(js檔案提取)

  • 利用爬蟲從頁面原始碼中提取子域名，比如JSFinder。

二、程式碼實現

這裡分別使用兩種方式實現子域名的挖掘，即通過證書SSL查詢和js檔案提取。

1.使用證書SSL查詢方式

參考文章漏洞挖掘-子域名，從線上網站crt中直接提取相關的子域名。

  1. # !/usr/bin/env python3
  2. # -*- coding: utf-8 -*-
  4. import sys
  5. import urllib.request
  6. import urllib.parse
  7. import re
  8. import ssl
  9. ssl._create_default_https_context = ssl._create_unverified_context
  11. def crt_domain(domains):
  12.     headers = {
  13.         'User-Agent': 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6'
  14.     }
  15.     with urllib.request.urlopen('https://crt.sh/?q=' + domains) as f:
  16.         code = f.read().decode('utf-8')
  17.         for cert, domain in re.findall('<tr>(?:\s|\S)*?href="\?id=([0-9]+?)"(?:\s|\S)*?<td>([*_a-zA-Z0-9.-]+?\.' + re.escape(domains) + ')</td>(?:\s|\S)*?</tr>', code, re.IGNORECASE):
  18.             domain = domain.split('@')[-1]
  19.             print(domain)
  20.             with open('crt_result.txt', 'a+') as f:
  21.                 f.write(str(domain)+'\n')
  23. if __name__ == '__main__':
  24.     if len(sys.argv) == 2:
  25.         domains=sys.argv[1]
  26.         crt_domain(domains[11:])
  27.     else:
  28.         print('User: python3 crt_domain.py domain')

C#呼叫指令碼

對於python指令碼中包含第三方模組的情況，同樣，通過直接建立Process程序，呼叫python指令碼，返回掃描結果。

  • 建立按鈕按下事件button1_Click，執行“呼叫python指令碼”函式runPythonSubdomain_ssl()
  1.  private void button9_Click(object sender, EventArgs e)
  2.         {
  3.             richTextBox4.Clear();
  4.             runPythonSubdomain_ssl();//執行python函式
  5.             label22.Text = "開始掃描...";
  6.         }
  • 例項化一個python程序 呼叫.py 指令碼
  1. void runPythonSubdomain_ssl()
  2.         {
  3.             string url = textBox9.Text;
  4.             p = new Process();
  5.             string path = "Subdomain.py";//待處理python檔案的路徑，本例中放在debug資料夾下
  6.             string sArguments = path;
  7.             ArrayList arrayList = new ArrayList();
  8.             arrayList.Add(url);//需要挖掘的域名
  9.             foreach (var param in arrayList)//拼接引數
  10.             {
  11.                 sArguments += " " + param;
  12.             }
  13.             p.StartInfo.FileName = @"D:\Anaconda\python.exe"; //沒有配環境變數的話，可以寫"xx\xx\python.exe"的絕對路徑。如果配了，直接寫"python"即可
  14.             p.StartInfo.Arguments = sArguments;//python命令的引數
  15.             p.StartInfo.UseShellExecute = false;
  16.             p.StartInfo.RedirectStandardOutput = true;
  17.             p.StartInfo.RedirectStandardInput = true;
  18.             p.StartInfo.RedirectStandardError = true;
  19.             p.StartInfo.CreateNoWindow = true;
  20.             p.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;
  21.             p.Start();//啟動程序
  22.             //MessageBox.Show("啟動成功");
  23.             p.BeginOutputReadLine();
  24.             p.OutputDataReceived += new DataReceivedEventHandler(p_OutputDataReceived_subdomain_ssl);
  25.             Console.ReadLine();
  26.             //p.WaitForExit();
  27.         }
  29.         void p_OutputDataReceived_subdomain_ssl(object sender, DataReceivedEventArgs e)
  30.         {
  31.             var printedStr = e.Data;
  32.             Action at = new Action(delegate ()
  33.             {
  34.                 //接受.py程序列印的字元資訊到文字顯示框
  35.                 richTextBox4.AppendText(printedStr + "\n");
  36.                 label22.Text = "掃描結束";
  37.             });
  38.             Invoke(at);
  39.         }

2.使用js檔案提取

  1. #!/usr/bin/env python"
  2. # coding: utf-8
  4. import requests, argparse, sys, re
  5. from requests.packages import urllib3
  6. from urllib.parse import urlparse
  7. from bs4 import BeautifulSoup
  9. def parse_args():
  10.     parser = argparse.ArgumentParser(epilog='\tExample: \r\npython ' + sys.argv[0] + " -u http://www.baidu.com")
  11.     parser.add_argument("-u", "--url", help="The website")
  12.     parser.add_argument("-c", "--cookie", help="The website cookie")
  13.     parser.add_argument("-f", "--file", help="The file contains url or js")
  14.     parser.add_argument("-ou", "--outputurl", help="Output file name. ")
  15.     parser.add_argument("-os", "--outputsubdomain", help="Output file name. ")
  16.     parser.add_argument("-j", "--js", help="Find in js file", action="store_true")
  17.     parser.add_argument("-d", "--deep",help="Deep find", action="store_true")
  18.     return parser.parse_args()
  20. def extract_URL(JS):
  21. 	pattern_raw = r"""
  22. 	  (?:"|')                               # Start newline delimiter
  23. 	  (
  24. 	    ((?:[a-zA-Z]{1,10}://|//)           # Match a scheme [a-Z]*1-10 or //
  25. 	    [^"'/]{1,}\.                        # Match a domainname (any character + dot)
  26. 	    [a-zA-Z]{2,}[^"']{0,})              # The domainextension and/or path
  27. 	    |
  28. 	    ((?:/|\.\./|\./)                    # Start with /,../,./
  29. 	    [^"'><,;| *()(%%$^/\\\[\]]          # Next character can't be...
  30. 	    [^"'><,;|()]{1,})                   # Rest of the characters can't be
  31. 	    |
  32. 	    ([a-zA-Z0-9_\-/]{1,}/               # Relative endpoint with /
  33. 	    [a-zA-Z0-9_\-/]{1,}                 # Resource name
  34. 	    \.(?:[a-zA-Z]{1,4}|action)          # Rest + extension (length 1-4 or action)
  35. 	    (?:[\?|/][^"|']{0,}|))              # ? mark with parameters
  36. 	    |
  37. 	    ([a-zA-Z0-9_\-]{1,}                 # filename
  38. 	    \.(?:php|asp|aspx|jsp|json|
  39. 	         action|html|js|txt|xml)             # . + extension
  40. 	    (?:\?[^"|']{0,}|))                  # ? mark with parameters
  41. 	  )
  42. 	  (?:"|')                               # End newline delimiter
  43. 	"""
  44. 	pattern = re.compile(pattern_raw, re.VERBOSE)
  45. 	result = re.finditer(pattern, str(JS))
  46. 	if result == None:
  47. 		return None
  48. 	js_url = []
  49. 	return [match.group().strip('"').strip("'") for match in result
  50. 		if match.group() not in js_url]
  52. # 傳送請求
  53. def Extract_html(URL):
  54. 	header = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36",
  55. 	"Cookie": args.cookie}
  56. 	try:
  57. 		raw = requests.get(URL, headers = header, timeout=3, verify=False)
  58. 		raw = raw.content.decode("utf-8", "ignore")
  59. 		return raw
  60. 	except:
  61. 		return None
  63. # 處理url
  64. def process_url(URL, re_URL):
  65. 	black_url = ["javascript:"]	# Add some keyword for filter url.
  66. 	URL_raw = urlparse(URL)
  67. 	ab_URL = URL_raw.netloc
  68. 	host_URL = URL_raw.scheme
  69. 	if re_URL[0:2] == "//":
  70. 		result = host_URL  + ":" + re_URL
  71. 	elif re_URL[0:4] == "http":
  72. 		result = re_URL
  73. 	elif re_URL[0:2] != "//" and re_URL not in black_url:
  74. 		if re_URL[0:1] == "/":
  75. 			result = host_URL + "://" + ab_URL + re_URL
  76. 		else:
  77. 			if re_URL[0:1] == ".":
  78. 				if re_URL[0:2] == "..":
  79. 					result = host_URL + "://" + ab_URL + re_URL[2:]
  80. 				else:
  81. 					result = host_URL + "://" + ab_URL + re_URL[1:]
  82. 			else:
  83. 				result = host_URL + "://" + ab_URL + "/" + re_URL
  84. 	else:
  85. 		result = URL
  86. 	return result
  88. def find_last(string,str):
  89. 	positions = []
  90. 	last_position=-1
  91. 	while True:
  92. 		position = string.find(str,last_position+1)
  93. 		if position == -1:break
  94. 		last_position = position
  95. 		positions.append(position)
  96. 	return positions
  98. def find_by_url(url, js = False):
  99. 	if js == False:
  100. 		try:
  101. 			print("url:" + url)
  102. 		except:
  103. 			print("Please specify a URL like https://www.baidu.com")
  104. 		html_raw = Extract_html(url)
  105. 		if html_raw == None:
  106. 			print("Fail to access " + url)
  107. 			return None
  108. 		#print(html_raw)
  109. 		html = BeautifulSoup(html_raw, "html.parser")
  110. 		html_scripts = html.findAll("script")
  111. 		script_array = {}
  112. 		script_temp = ""
  113. 		for html_script in html_scripts:
  114. 			script_src = html_script.get("src")
  115. 			if script_src == None:
  116. 				script_temp += html_script.get_text() + "\n"
  117. 			else:
  118. 				purl = process_url(url, script_src)
  119. 				script_array[purl] = Extract_html(purl)
  120. 		script_array[url] = script_temp
  121. 		allurls = []
  122. 		for script in script_array:
  123. 			#print(script)
  124. 			temp_urls = extract_URL(script_array[script])
  125. 			if len(temp_urls) == 0: continue
  126. 			for temp_url in temp_urls:
  127. 				allurls.append(process_url(script, temp_url))
  128. 		result = []
  129. 		for singerurl in allurls:
  130. 			url_raw = urlparse(url)
  131. 			domain = url_raw.netloc
  132. 			positions = find_last(domain, ".")
  133. 			miandomain = domain
  134. 			if len(positions) > 1:miandomain = domain[positions[-2] + 1:]
  135. 			#print(miandomain)
  136. 			suburl = urlparse(singerurl)
  137. 			subdomain = suburl.netloc
  138. 			#print(singerurl)
  139. 			if miandomain in subdomain or subdomain.strip() == "":
  140. 				if singerurl.strip() not in result:
  141. 					result.append(singerurl)
  142. 		return result
  143. 	return sorted(set(extract_URL(Extract_html(url)))) or None
  145. def find_subdomain(urls, mainurl):
  146. 	url_raw = urlparse(mainurl)
  147. 	domain = url_raw.netloc
  148. 	miandomain = domain
  149. 	positions = find_last(domain, ".")
  150. 	if len(positions) > 1:miandomain = domain[positions[-2] + 1:]
  151. 	subdomains = []
  152. 	for url in urls:
  153. 		suburl = urlparse(url)
  154. 		subdomain = suburl.netloc
  155. 		#print(subdomain)
  156. 		if subdomain.strip() == "": continue
  157. 		if miandomain in subdomain:
  158. 			if subdomain not in subdomains:
  159. 				subdomains.append(subdomain)
  160. 	return subdomains
  162. def find_by_url_deep(url):
  163. 	html_raw = Extract_html(url)
  164. 	if html_raw == None:
  165. 		print("Fail to access " + url)
  166. 		return None
  167. 	html = BeautifulSoup(html_raw, "html.parser")
  168. 	html_as = html.findAll("a")
  169. 	links = []
  170. 	for html_a in html_as:
  171. 		src = html_a.get("href")
  172. 		if src == "" or src == None: continue
  173. 		link = process_url(url, src)
  174. 		if link not in links:
  175. 			links.append(link)
  176. 	if links == []: return None
  177. 	print("ALL Find " + str(len(links)) + " links")
  178. 	urls = []
  179. 	i = len(links)
  180. 	for link in links:
  181. 		temp_urls = find_by_url(link)
  182. 		if temp_urls == None: continue
  183. 		print("Remaining " + str(i) + " | Find " + str(len(temp_urls)) + " URL in " + link)
  184. 		for temp_url in temp_urls:
  185. 			if temp_url not in urls:
  186. 				urls.append(temp_url)
  187. 		i -= 1
  188. 	return urls
  190. def find_by_file(file_path, js=False):
  191. 	with open(file_path, "r") as fobject:
  192. 		links = fobject.read().split("\n")
  193. 	if links == []: return None
  194. 	print("ALL Find " + str(len(links)) + " links")
  195. 	urls = []
  196. 	i = len(links)
  197. 	for link in links:
  198. 		if js == False:
  199. 			temp_urls = find_by_url(link)
  200. 		else:
  201. 			temp_urls = find_by_url(link, js=True)
  202. 		if temp_urls == None: continue
  203. 		print(str(i) + " Find " + str(len(temp_urls)) + " URL in " + link)
  204. 		for temp_url in temp_urls:
  205. 			if temp_url not in urls:
  206. 				urls.append(temp_url)
  207. 		i -= 1
  208. 	return urls
  210. def giveresult(urls, domian):
  211. 	if urls == None:
  212. 		return None
  213. 	print("Find " + str(len(urls)) + " URL:")
  214. 	content_url = ""
  215. 	content_subdomain = ""
  216. 	for url in urls:
  217. 		content_url += url + "\n"
  218. 		print(url)
  219. 	subdomains = find_subdomain(urls, domian)
  220. 	print("\nFind " + str(len(subdomains)) + " Subdomain:")
  221. 	for subdomain in subdomains:
  222. 		content_subdomain += subdomain + "\n"
  223. 		print(subdomain)
  224. 	if args.outputurl != None:
  225. 		with open(args.outputurl, "a", encoding='utf-8') as fobject:
  226. 			fobject.write(content_url)
  227. 		print("\nOutput " + str(len(urls)) + " urls")
  228. 		print("Path:" + args.outputurl)
  229. 	if args.outputsubdomain != None:
  230. 		with open(args.outputsubdomain, "a", encoding='utf-8') as fobject:
  231. 			fobject.write(content_subdomain)
  232. 		print("\nOutput " + str(len(subdomains)) + " subdomains")
  233. 		print("Path:" + args.outputsubdomain)
  235. if __name__ == "__main__":
  236. 	urllib3.disable_warnings()
  237. 	args = parse_args()
  238. 	if args.file == None:
  239. 		if args.deep is not True:
  240. 			urls = find_by_url(args.url)
  241. 			giveresult(urls, args.url)
  242. 		else:
  243. 			urls = find_by_url_deep(args.url)
  244. 			giveresult(urls, args.url)
  245. 	else:
  246. 		if args.js is not True:
  247. 			urls = find_by_file(args.file)
  248. 			giveresult(urls, urls[0])
  249. 		else:
  250. 			urls = find_by_file(args.file, js = True)
  251. 			giveresult(urls, urls[0])

C#呼叫指令碼

  • 建立按鈕按下事件button1_Click，執行“呼叫python指令碼”函式runPythonSubdomain_js()
  1. private void button10_Click(object sender, EventArgs e)
  2.         {
  3.             richTextBox5.Clear();
  4.             runPythonSubdomain_js();//執行python函式
  5.             label24.Text = "開始掃描...";
  6.         }
  • 例項化一個python程序 呼叫.py 指令碼
  1. void runPythonSubdomain_js()
  2.         {
  3.             string url = textBox9.Text;
  4.             p = new Process();
  5.             string path = "JSFinder.py";//待處理python檔案的路徑，本例中放在debug資料夾下
  6.             string sArguments = path;
  7.             ArrayList arrayList = new ArrayList();
  8.             arrayList.Add("-u");
  9.             arrayList.Add(url);//需要挖掘的域名
  10.             foreach (var param in arrayList)//拼接引數
  11.             {
  12.                 sArguments += " " + param;
  13.             }
  14.             p.StartInfo.FileName = @"D:\Anaconda\python.exe"; //沒有配環境變數的話，可以寫"xx\xx\python.exe"的絕對路徑。如果配了，直接寫"python"即可
  15.             p.StartInfo.Arguments = sArguments;//python命令的引數
  16.             p.StartInfo.UseShellExecute = false;
  17.             p.StartInfo.RedirectStandardOutput = true;
  18.             p.StartInfo.RedirectStandardInput = true;
  19.             p.StartInfo.RedirectStandardError = true;
  20.             p.StartInfo.CreateNoWindow = true;
  21.             p.StartInfo.WindowStyle = ProcessWindowStyle.Hidden;
  22.             p.Start();//啟動程序
  23.             //MessageBox.Show("啟動成功");
  24.             p.BeginOutputReadLine();
  25.             p.OutputDataReceived += new DataReceivedEventHandler(p_OutputDataReceived_subdomain_js);
  26.             Console.ReadLine();
  27.             //p.WaitForExit();
  28.         }
  30.         void p_OutputDataReceived_subdomain_js(object sender, DataReceivedEventArgs e)
  31.         {
  32.             var printedStr = e.Data;
  33.             Action at = new Action(delegate ()
  34.             {
  35.                 //接受.py程序列印的字元資訊到文字顯示框
  36.                 richTextBox5.AppendText(printedStr + "\n");
  37.                 label24.Text = "掃描結束";
  38.             });
  39.             Invoke(at);
  40.         }
  41.     }
  42. }

三、使用步驟

  • 首先在url欄中輸入地址，接著可以選擇是使用ssl證書提取或者Js檔案提取的方式進行挖掘，最後得到子域名資訊。

github地址：https://github.com/Chenmengx/Penetration-testing-tool