Sublist3r使用教程#

# 克隆仓库
git clone https://github.com/aboul3la/Sublist3r.git

# 进入目录
cd Sublist3r

# 安装依赖
pip install -r requirements.txt

# 基本子域名枚举
python sublist3r.py -d example.com

# 使用特定搜索引擎
python sublist3r.py -d example.com -e google

# 使用多个搜索引擎
python sublist3r.py -d example.com -e google,bing,yahoo

# 查看帮助信息
python sublist3r.py -h

# 使用多个搜索引擎
python sublist3r.py -d example.com -e google,bing,yahoo,duckduckgo

# 使用所有支持的搜索引擎
python sublist3r.py -d example.com -e all

# 保存结果到文件
python sublist3r.py -d example.com -o subdomains.txt

# 保存结果到指定路径
python sublist3r.py -d example.com -o /path/to/subdomains.txt

# 设置线程数量为10
python sublist3r.py -d example.com -t 10

# 设置线程数量为20
python sublist3r.py -d example.com -t 20

# 使用自定义字典
python sublist3r.py -d example.com -b custom_wordlist.txt

# 使用内置字典
python sublist3r.py -d example.com -b

# 启用DNS解析验证
python sublist3r.py -d example.com -v

# 查看解析结果
python sublist3r.py -d example.com -v -o subdomains.txt

# 检测通配符子域名
python sublist3r.py -d example.com -w

# 如果存在通配符，Sublist3r会提示

# 对子域名进行端口扫描
python sublist3r.py -d example.com -p 80,443,22

# 扫描常用端口
python sublist3r.py -d example.com -p 80,443,8080,8443

# 扫描指定端口范围
python sublist3r.py -d example.com -p 1-1000

# 创建域名列表文件
# domains.txt内容：
# example.com
# test.com
# demo.com

# 批量扫描
python sublist3r.py -d domains.txt -o results.txt

# 使用VirusTotal API
python sublist3r.py -d example.com -a virustotal

# 使用SecurityTrails API
python sublist3r.py -d example.com -a securitytrails

# 使用多个API
python sublist3r.py -d example.com -a virustotal,securitytrails

# 修改Sublist3r源代码添加自定义搜索引擎
# 在engines.py中添加新的搜索引擎类

class CustomSearchEngine:
    def __init__(self):
        self.name = "CustomEngine"
        self.base_url = "https://custom.engine.com/search?q="
    
    def search(self, domain):
        query = f"site:{domain}"
        url = self.base_url + query
        # 实现搜索逻辑
        return subdomains

# 枚举子域名
python sublist3r.py -d example.com -o subdomains.txt

# 去重
sort subdomains.txt | uniq > unique_subdomains.txt

# 分析子域名模式
cat unique_subdomains.txt | grep -E "^[a-z]+\." | sort | uniq -c

# 自动化脚本示例
import subprocess
import json

def enumerate_subdomains(domain):
    # 运行Sublist3r
    result = subprocess.run(
        ['python', 'sublist3r.py', '-d', domain, '-o', f'{domain}.txt', '-j'],
        capture_output=True,
        text=True
    )
    
    # 读取结果
    with open(f'{domain}.txt', 'r') as f:
        subdomains = f.read().splitlines()
    
    return subdomains

# 使用示例
domains = ['example.com', 'test.com']
for domain in domains:
    subdomains = enumerate_subdomains(domain)
    print(f"Found {len(subdomains)} subdomains for {domain}")

# 大规模枚举脚本
import multiprocessing
import subprocess

def enumerate_domain(domain):
    result = subprocess.run(
        ['python', 'sublist3r.py', '-d', domain, '-o', f'results/{domain}.txt'],
        capture_output=True,
        text=True
    )
    return domain

# 使用多进程
domains = open('domains.txt').read().splitlines()
with multiprocessing.Pool(processes=10) as pool:
    results = pool.map(enumerate_domain, domains)

print(f"Completed enumeration for {len(results)} domains")

# 子域名情报分析脚本
import dns.resolver
import requests

def analyze_subdomain(subdomain):
    info = {
        'subdomain': subdomain,
        'ip_addresses': [],
        'http_status': None,
        'server': None,
        'technologies': []
    }
    
    # DNS解析
    try:
        answers = dns.resolver.resolve(subdomain, 'A')
        for rdata in answers:
            info['ip_addresses'].append(rdata.address)
    except:
        pass
    
    # HTTP请求
    try:
        response = requests.get(f'http://{subdomain}', timeout=5)
        info['http_status'] = response.status_code
        info['server'] = response.headers.get('Server', '')
    except:
        pass
    
    return info

# 使用示例
subdomains = open('subdomains.txt').read().splitlines()
for subdomain in subdomains:
    info = analyze_subdomain(subdomain)
    print(json.dumps(info, indent=2))

# 子域名监控系统
import time
import smtplib
from email.mime.text import MIMEText

def monitor_subdomains(domain, known_subdomains):
    # 枚举当前子域名
    result = subprocess.run(
        ['python', 'sublist3r.py', '-d', domain, '-o', 'current.txt'],
        capture_output=True,
        text=True
    )
    
    # 读取当前子域名
    with open('current.txt', 'r') as f:
        current_subdomains = set(f.read().splitlines())
    
    # 比较差异
    new_subdomains = current_subdomains - known_subdomains
    removed_subdomains = known_subdomains - current_subdomains
    
    # 发送告警
    if new_subdomains or removed_subdomains:
        send_alert(domain, new_subdomains, removed_subdomains)
    
    return current_subdomains

def send_alert(domain, new, removed):
    # 发送邮件告警
    msg = MIMEText(f"Subdomain changes detected for {domain}\n\nNew: {new}\nRemoved: {removed}")
    msg['Subject'] = f"Subdomain Alert: {domain}"
    msg['From'] = "monitor@example.com"
    msg['To'] = "admin@example.com"
    
    # 发送邮件
    # smtplib.SMTP('smtp.example.com').send_message(msg)
    pass

# 使用示例
domain = "example.com"
known_subdomains = set()

while True:
    known_subdomains = monitor_subdomains(domain, known_subdomains)
    time.sleep(3600)  # 每小时检查一次