search

yogeshojha / rengine

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
https://yogeshojha.github.io/rengine/
GNU General Public License v3.0
7.25k stars 1.1k forks source link

Feature - Implement the tool 'Gotator' to permutate subdomains #545

Open alph4byt3 opened 2 years ago

alph4byt3 commented 2 years ago

Subdomain permutation is another way to find uncommon subdomains. Implementing the tool Gotator - https://github.com/Josue87/gotator will allow us to permutate domains/ subdomains.

The pipeline can look something like this:

1) Use tools already implemented to gather all subdomains (Amass, Subfinder etc) 2) Use the tool Puredns (I created a feature request to add this tool) to bruteforce subdomains from a custom wordlist (hopefully reNgine would manage to work with my 42mil line, 800MB wordlist). 3) Store a copy of all the subdomains found. 4) Use Gotator with a custom/ default permutations wordlist to then start permutating the root domain. 5) Append all permutated subdomains found to the first file saved in step 3. 6) Then use Puredns again to resolve all the gathered subdomains (the tool can resolve and bruteforce)

Then reNgine can cleanup unnecessary files left over and have the single main large subdomain file.

Note: Allow users to add their own resolvers for the Puredns tool, a custom list of working resolvers will cut time in half (e.g my 42mil list takes ~ 40 minutes on default Puredns settings) and it will prevent false negatives.

Hopefully this is understandable, this is my subdomain recon methodology that brings me success. I usually do steps 2 and 5 on my own and then add the results I find to reNgine before starting the scan (add custom subdomains) so having it all implemented into the framework will be a big benefit not only to me but all.

github-actions[bot] commented 2 years ago

👋 Hi @alph4byt3, Issues is only for reporting a bug/feature request. Please read documentation before raising an issue https://rengine.wiki For very limited support, questions, and discussions, please join reNgine Discord channel: https://discord.gg/azv6fzhNCE Please include all the requested and relevant information when opening a bug report. Improper reports will be closed without any response.

alph4byt3 commented 2 years ago

I forgot to mention that obviously between 5 and 6 you would sort and uniq all the subdomains before resolving them.