1. import pydig
2. import dns.resolver
3. import tldextract
4. import whois
5. import requests
6. import json
7. from multiprocessing import Pool, cpu_count
8.  
9. requests.packages.urllib3.disable_warnings()
10.  
11. def sorgu(sub):
12.         print(sub)
13.  
14.         try:
15.                 dns_sorgula = dns.resolver.query(sub,"A")
16.                 requestsender(sub)
17.  
18.         except dns.resolver.NXDOMAIN:
19.                 dns_sorgula = pydig.query(sub,"CNAME")
20.                 if dns_sorgula:
21.                         parse = tldextract.extract(dns_sorgula[0])
22.                         parse = parse.domain + "." + parse.suffix
23.  
24.                         if parse in microsoft_list:
25.                                 slacksend(sub,parse)
26.                         else:
27.                                 domain = whois.query(parse)
28.                                 if domain == None:
29.                                         slacksend(sub,"you can buy cname record")
30.                                 else:
31.                                         pass
32.                 else:
33.                         pass
34.         except dns.resolver.NoAnswer:
35.                 pass
36.  
37.         except:
38.                 pass
39.  
40. def slacksend(sub,service):
41.         slack_data = {'text':f'Subdomain Takeover Found: {str(sub)}\nService: {str(service)}'}
42.         slack_send = requests.post(posting_webhook, data=json.dumps(slack_data), headers={'Content-Type': 'application/json'})
43.  
44. def statusattack(x):
45.         slack_data = {'text':f'Status: {x}'}
46.         slack_send = requests.post(posting_webhook, data=json.dumps(slack_data), headers={'Content-Type': 'application/json'})
47.  
48. def requestsender(sub):
49.         header = {"User-Agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Mobile/15E148 Safari/604.1"}
50.         try:
51.                 site = "http://"+str(sub)
52.                 istek = requests.get(site,verify=False,headers=header,timeout=2).text
53.                 takeoversender(istek,sub)
54.  
55.         except requests.exceptions.ConnectionError:
56.                 site = "https://"+str(sub)
57.                 istek = requests.get(site,verify=False,headers=header,timeout=2).text
58.                 takeoversender(istek,sub)
59.  
60.         except:
61.                 pass
62.  
63. def takeoversender(istek,sub):
64.         response = [("There isn't a GitHub Pages site here.","Github"),
65.         ("The specified bucket does not exist","S3BUCKET"),
66.         ("NoSuchBucket","S3BUCKET"),
67.         ("Fastly error: unknown domain","Fastly"),
68.         ("Repository not found","Bitbucket"),
69.         ("Trying to access your account?","Campaign Monitor"),
70.         ("Domain uses DO name serves with no records in DO.","Digitalocean"),
71.         ("The feed has not been found.","Feedpress"),
72.         ("The thing you were looking for is no longer here, or never was","Ghost"),
73.         ("404 Blog is not found","HatenaBlog"),
74.         ("We could not find what you're looking for.","Help Juice"),
75.         ("No settings were found for this company:","Help Scout"),
76.         ("No such app","Heroku"),
77.         ("Uh oh. That page doesn't exist.","Intercom"),
78.         ("is not a registered InCloud YouTrack","JetBrains"),
79.         ("No Site For Domain","Kinsta"),
80.         ("It looks like you may have taken a wrong turn somewhere. Don't worry...","LaunchRock"),
81.         ("Unrecognized domain","Mashery"),
82.         ("404 error unknown site!","Pantheon"),
83.         ("Project doesnt exist... yet!","Readme.io"),
84.         ("Sorry, this shop is currently unavailable.","Shopify"),
85.         ("Visiting the subdomain will redirect users to","Statuspage"),
86.         ("project not found","Surge.sh"),
87.         ("Whatever you were looking for doesn't currently exist at this address","Tumblr"),
88.         ("Please renew your subscription","Tilda"),
89.         ("This UserVoice subdomain is currently available!","UserVoice"),
90.         ("Do you want to register *.wordpress.com?","Wordpress")]
91.  
92.         for bul in response:
93.                 if bul[0] in istek:
94.                         slacksend(sub,bul[1])
95.                 else:
96.                         pass
97.  
98. def test(sub):
99.         sayı = 0
100.         blacklist = ["*","-.",".-","..",".,",",.","?","/",")","(","]","[",">","<","!","#","&",",","{","}","+","%","|"]
101.  
102.         for i in blacklist:
103.                 if i in sub:
104.                         sayı +=1
105.                 else:
106.                         pass
107.  
108.         if sayı == 0:
109.                 return True
110.         else:
111.                 return False
112.  
113. def main():
114.         target_list = []
115.  
116.         with open("subdomains.txt","r",encoding="utf-8") as f:
117.                 [target_list.append(i) for i in f.read().lower().split("\n") if i and test(i)]
118.  
119.         with Pool(cpu_count()) as p:
120.                 p.map(sorgu,target_list)
121.  
122. if __name__ == "__main__":
123.         posting_webhook = "https://hooks.slack.com/services/SLACK-HOOK-ADDRESS"
124.  
125.         microsoft_list = ["trafficmanager.net","cloudapp.net","azure.com","azurewebsites.net",
126.         "windows.net","azure-api.net","azurehdinsight.net","azureedge.net","azurecontainer.io",
127.         "azuredatalakestore.net","azurecr.io","visualstudio.com"]
128.  
129.         statusattack("Subdomain Takeover Attack started")
130.  
131.         main()
132.  
133.         statusattack("Subdomain Takeover Attack Finished")