Domainim is a quick area reconnaissance software for organizational community scanning. The software goals to offer a quick overview of a corporation’s construction utilizing methods like OSINT, bruteforcing, DNS resolving and so on.
Present options (v1.0.1)- – Subdomain enumeration (2 engines + bruteforcing) – Person-friendly output – Resolving A information (IPv4)
- Digital hostname enumeration
- Reverse DNS lookup
- Detects wildcard subdomains (for bruteforcing)
- Fundamental TCP port scanning
- Subdomains are accepted as enter
- Export outcomes to JSON file
A couple of options are work in progress. See Deliberate options for extra particulars.
The challenge is impressed by Sublist3r. The port scanner module is closely based mostly on NimScan.
You may construct this repo from source- – Clone the repository
git clone [email protected]:pptx704/domainim
nimble construct
./domainim [--ports=]
Or, you may simply obtain the binary from the launch web page. Remember that the binary is examined on Debian based mostly techniques solely.
./domainim [--ports= | -p:] [--wordlist= | l: [--rps= | -r:]] [--dns= | -d:] [--out= | -o:]
-- ports | -pis a string speicification of the ports to be scanned. It may be one of many following-all– Scan all ports (1-65535)none– Skip port scanning (default)t– Scan high n ports (similar asnmap). i.e.t100scans high 100 ports. Max worth is 5000. If n is bigger than 5000, it is going to be set to 5000.- single worth – Scan a single port. i.e.
80scans port 80 - vary worth – Scan a spread of ports. i.e.
80-100scans ports 80 to 100 - comma separated values – Scan a number of ports. i.e.
80,443,8080scans ports 80, 443 and 8080 - mixture – Scan a mixture of the above. i.e.
80,443,8080-8090,t500scans ports 80, 443, 8080 to 8090 and high 500 ports --dns | -dis the handle of the dns server. This ought to be a sound IPv4 handle and may optionally include the port number-a.b.c.d– Use DNS server ata.b.c.don port 53a.b.c.d#n– Use DNS server ata.b.c.don porte--wordlist | -l– Path to the wordlist file. That is used for bruteforcing subdomains. If the file is invalid, bruteforcing will probably be skipped. You may get a wordlist from SecLists. A wordlist can be supplied within the launch web page.--rps | -r– Variety of requests to be made per second throughout bruteforce. The default worth is1024 req/s. It’s to be famous that, DNS queries are made in batches and subsequent batch is made solely after the earlier one is accomplished. Since quries might be fee restricted, growing the worth doesn’t all the time assure quicker outcomes.--out | -o– Path to the output file. The output will probably be saved in JSON format. The filename should finish with.json.
Examples – ./domainim nmap.org --ports=all – ./domainim google.com --ports=none --dns=8.8.8.8#53 – ./domainim pptx704.com --ports=t100 --wordlist=wordlist.txt --rps=1500 – ./domainim pptx704.com --ports=t100 --wordlist=wordlist.txt --outfile=outcomes.json – ./domainim mysite.com --ports=t50,5432,7000-9000 --dns=1.1.1.1
The assistance menu might be accessed utilizing ./domainim --help or ./domainim -h.
Utilization:
domainim [--ports= | -p:] [--wordlist= | l: [--rps= | -r:]] [--dns= | -d:] [--out= | -o:]
domainim (-h | --help)Choices:
-h, --help Present this display.
-p, --ports Ports to scan. [default: `none`]
May be `all`, `none`, `t`, single worth, vary worth, mixture
-l, --wordlist Wordlist for subdomain bruteforcing. Bruteforcing is skipped for invalid file.
-d, --dns IP and Port for DNS Resolver. Needs to be a sound IPv4 with an elective port [default: system default]
-r, --rps DNS queries to be made per second [default: 1024 req/s]
-o, --out JSON file the place the output will probably be saved. Filename should finish with `.json`
Examples:
domainim domainim.com -p:t500 -l:wordlist.txt --dns:1.1.1.1#53 --out=outcomes.json
domainim sub.domainim.com --ports=all --dns:8.8.8.8 -t:1500 -o:outcomes.json
The JSON schema for the outcomes is as follows-
[
{
"subdomain": string,
"data": [
"ipv4": string,
"vhosts": [string],
"reverse_dns": string,
"ports": [int]
]
}
]
Instance json for nmap.org might be discovered right here.
Contributions are welcome. Be at liberty to open a pull request or a difficulty.
Deliberate Options
- [x] TCP port scanning
- [ ] UDP port scanning assist
- [ ] Resolve AAAA information (IPv6)
- [x] Customized DNS server
- [x] Add bruteforcing subdomains utilizing a wordlist
- [ ] Pressure bruteforcing (even when wildcard subdomain is discovered)
- [ ] Add extra engines for subdomain enumeration
- [x] File output (JSON)
- [ ] A number of area enumeration
- [ ] Dir and File busting
Others
- [x] Replace verbose output when encountering errors (v0.2.0)
- [x] Present progress bar for longer operations
- [ ] Add particular person port scan progress bar
- [ ] Add exams
- [ ] Add feedback and docstrings
This challenge remains to be in its early levels. There are a number of limitations I’m conscious of.
The 2 engines I’m utilizing (I am calling them engine as a result of Sublist3r does so) at present have some form of response restrict. dnsdumpster.com”>dnsdumpster can fetch upto 100 subdomains. crt.sh additionally randomizes the leads to case of too many outcomes. One other difficulty with crt.sh is the truth that it returns some SQL error generally. So for some area, outcomes might be completely different for various runs. I’m planning so as to add extra engines sooner or later (not less than a brute pressure engine).
The port scanner has solely ping response time + 750ms timeout. This would possibly result in false negatives. Since, domainim will not be meant for port scanning however to offer a fast overview, such instances are acceptable. Nevertheless, I’m planning so as to add a flag to extend the timeout. For a similar cause, filtered ports will not be proven. For extra complete port scanning, I like to recommend utilizing Nmap. Domainim additionally would not bypass fee limiting (if there may be any).
It might sound that the best way vhostnames are printed, it simply brings repeition on the desk.
Printing as the next would possibly’ve been better-
ack.nmap.org, points.nmap.org, nmap.org, analysis.nmap.org, scannme.nmap.org, svn.nmap.org, www.nmap.org
↳ 45.33.49.119
↳ Reverse DNS: ack.nmap.org.
However beforehand whereas testing, I discovered instances the place not all IPs are shared by similar set of vhostnames. That’s the reason I made a decision to maintain it this fashion.
DNS server might need some form of fee limiting. That is why I added random delays (between 0-300ms) for IPv4 resolving per question. That is to not make the DNS server get all of the queries without delay however fairly in a extra pure method. For bruteforcing methodology, the worth is between 0-1000ms by default however that may be modified utilizing --rps | -t flag.
One explicit limitation that’s bugging me is that the DNS resolver wouldn’t return all of the IPs for a website. So it’s essential to make a number of queries to get all (or most) of the IPs. However then once more, it isn’t potential to know what number of IPs are there for a website. I nonetheless should give you an answer for this. Additionally, nim-ndns would not assist CNAME information. So, if a website has a CNAME document, it is not going to be resolved. I’m ready for a response from the writer for this.
For now, bruteforcing is skipped if a potential wildcard subdomain is discovered. It’s because, if a website has a wildcard subdomain, bruteforcing will resolve IPv4 for all potential subdomains. Nevertheless, this can skip legitimate subdomains additionally (i.e. scanme.nmap.org will probably be skipped though it is not a wildcard worth). I’ll add a --force-brute | -fb flag later to pressure bruteforcing.
Comparable factor is true for VHost enumeration for subdomain inputs. Since, urls that ends with given subdomains are returned, subdomains of comparable domains will not be thought of. For instance, scannme.nmap.org is not going to be printed for ack.nmap.org however one thing.ack.nmap.org is likely to be. I can seek for all subdomains of nmap.org however that defeats the aim of getting a subdomains as an enter.
MIT License. See LICENSE for full textual content.
