在线子域名爆破
1 <?php 2 3 function domainfuzz($domain) { 4 $ip = gethostbyname($domain); 5 preg_match("/\d+\.\d+\.\d+\.\d+/",$ip,$arr); 6 return $arr; 7 } 8 9 function main() { 10 if(isset($_GET['q'])) { 11 $return = array(); 12 $domain = trim($_GET["domain"]); 13 //前缀字典 14 $q = trim($_GET["q"]); 15 preg_match("/(\w+\.\w+)$/",$domain,$arr); 16 $fuzz = $q.'.'.$arr[1]; 17 $result = domainfuzz($fuzz); 18 $return["domain"] = $fuzz; 19 if(empty($result)) { 20 $return["status"] = 500; 21 $return["ip"] = null; 22 } else { 23 $return["status"] = 200; 24 $return["ip"] = $result[0]; 25 } 26 echo json_encode($return); 27 } 28 } 29 30 main(); 31 if(!isset($_GET['q'])) { 32 ?> 33 <!DOCTYPE html> 34 <html> 35 <head> 36 <title>在线子域名爆破|Domain fuzz</title> 37 <meta charset="utf-8"> 38 <meta > 39 <link rel="stylesheet" href="//cdn.bootcss.com/bootstrap/3.3.5/css/bootstrap.min.css"> 40 <link rel="stylesheet" href="//cdn.bootcss.com/bootstrap/3.3.5/css/bootstrap-theme.min.css"> 41 <script src="//cdn.bootcss.com/jquery/1.11.3/jquery.min.js"></script> 42 <script src="//cdn.bootcss.com/bootstrap/3.3.5/js/bootstrap.min.js"></script> 43 <style type="text/css" media="screen"> 44 </style> 45 </head> 46 <body> 47 域名：<input type="text" id="domain"> 48 <button>开始</button> 49 <div id="fuzz"></div> 50 <div id="info"></div> 51 </body> 52 <script> 53 //字典自己添加 54 var dist = ["www","mail","ftp","smtp","kaoshi"]; 55 var num = 0; 56 var domain = ""; 57 $("button").click(function() { 58 num = 0; 59 domain = $("#domain").val(); 60 query(); 61 }); 62 function query() { 63 64 $.get("","domain="+domain+"&q="+dist[num],function(res){ 65 $("#fuzz").html(res.domain); 66 if(res.status == 200) { 67 $("#info").append("爆破成功："+ res.domain + "-" + res.ip+ "<br>"); 68 } 69 70 },"json"); 71 num++; 72 if(num<3000) { 73 query(); 74 } 75 } 76 //alert(dist.length); 77 </script> 78 </html> 79 80 <?php 81 82 } 83 ?>
在线C段查询小工具
1 <?php 2 3 function getIp($url) { 4 $data = file_get_contents("http://www.ip138.com/ips138.asp?ip={$url}&action=2"); 5 preg_match("/(\d+\.\d+\.\d+\.\d+)<\/font>/", $data, $arr); 6 if(!empty($arr[1])) { 7 return $arr[1]; 8 } 9 return $url; 10 } 11 12 function getBing($ip) { 13 $ctx = stream_context_create(array( 14 'http' => array( 15 'timeout' => 30, 16 //'proxy' => 'tcp://113.47.46.152:1080', 17 'request_fulluri' => True, 18 'header'=> "User-Agent: BaiduSpider\r\nAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3", 19 ) 20 ) 21 ); 22 $first = 1; 23 $res = array(); 24 while(true) { 25 $url = "http://www.bing.com/search?q=ip%3A{$ip}&go=%E6%8F%90%E4%BA%A4&qs=n&first={$first}&form=QBRE&pq=ip%3A{$ip}&sc=0-0&sp=-1&sk=&cvid=5e52385772e24683a0bdf047de60abfc"; 26 $first = $first + 10; 27 $result = file_get_contents($url, False, $ctx); 28 preg_match_all('/<h2><a href="((http|https):\/\/([\w|\.]+)\/)([\w|\/|&|=|\.|\?]+)?" h="ID=\w+,\w+\.\w+">/',$result,$arr); 29 if(!empty($arr[1])) { 30 foreach($arr[1] as $v) { 31 array_push($res, $v); 32 } 33 } 34 if(!preg_match('/<div class="sw_next">/', $result)) { 35 break; 36 } 37 38 } 39 return array_unique($res); 40 } 41 42 //getBing("58.96.186.133"); 43 44 function main() { 45 if(isset($_POST["action"])) { 46 $action = trim($_POST["action"]); 47 if($action == "getip") { 48 $domain = trim($_POST["domain"]); 49 $ip = getIp($domain); 50 echo $ip; 51 } 52 if($action == "query") { 53 $ip = trim($_POST["ip"]); 54 $res = getBing($ip); 55 echo json_encode($res); 56 } 57 } 58 } 59 60 main(); 61 if(empty($_POST['action'])) { 62 ?> 63 <!DOCTYPE html> 64 <html> 65 <head> 66 <title>必应接口C段查询|c段查询|旁站查询</title> 67 <meta charset="utf-8"> 68 <meta > 69 <link rel="stylesheet" href="//cdn.bootcss.com/bootstrap/3.3.5/css/bootstrap.min.css"> 70 <link rel="stylesheet" href="//cdn.bootcss.com/bootstrap/3.3.5/css/bootstrap-theme.min.css"> 71 <script src="//cdn.bootcss.com/jquery/1.11.3/jquery.min.js"></script> 72 <script src="//cdn.bootcss.com/bootstrap/3.3.5/js/bootstrap.min.js"></script> 73 <style type="text/css" media="screen"> 74 .main{ 75 width:90%; 76 //border:1px solid red; 77 margin-top:20px; 78 } 79 .ip{ 80 margin-top:10px; 81 } 82 dd{ 83 text-indent:10px; 84 } 85 </style> 86 </head> 87 <body> 88 <div class="container"> 89 <div class="main"> 90 <h1>必应接口C段查询 </h1> 91 <form class="form-inline"> 92 <div class="form-group" style=""> 93 <input type="text" id="domain" class="form-control" placeholder="输入你要查询的ip或域名"> 94 </div> 95 <button type="submit" class="btn btn-success" id="getip">获取ip</button> 96 <button type="submit" class="btn btn-info" id="query">查询</button> 97 </form> 98 <div class="alert alert-info ip" role="alert" style="display:none">IP:<span id="ip"></span><span id="se"></span></div> 99 <div class="progress" id="jd" style="display:none"> 100 <div class="progress-bar progress-bar-success progress-bar-striped" role="progressbar" aria-valuenow="40" id="b" aria-valuemin="0" aria-valuemax="100" style="width: 0%"> 101 <span class="sr-only">40% Complete (success)</span> 102 </div> 103 </div> 104 <dl id="result"> 105 106 </dl> 107 </div> 108 </div> 109 </body> 110 <script type="text/javascript"> 111 var ipi = 1; 112 $(function() { 113 $("#getip").click(function() { 114 var domain = $("#domain").val(); 115 if(domain == "") { 116 alert("请输入ip或者域名"); 117 return false; 118 } 119 $.post("","action=getip&domain="+domain,function(res) { 120 var ip = res; 121 $("#ip").html(ip); 122 $(".ip").show(); 123 arr = ip.split("."); 124 start = arr[0] + "." + arr[1] + "." + arr[2] + "." + 1; 125 end = arr[0] + "." + arr[1] + "." + arr[2] + "." + 255; 126 $("#se").html(" 查询ip段：" + start + "-" + end) 127 }) 128 }); 129 130 $("#query").click(function() { 131 ipi=1; 132 $("#b").css("width","0%"); 133 $("#result").html(""); 134 $("#jd").show(); 135 query(); 136 137 }); 138 }) 139 140 function query() { 141 $("#query").click(function() { 142 return; 143 }); 144 var html = ""; 145 var b = (ipi/255) * 100; 146 var ip = $("#ip").html(); 147 if(ip == "") { 148 alert("骚年请先获取Ip哦"); 149 return; 150 } 151 var arr = ip.split("."); 152 var ips = arr[0] + "." + arr[1] + "." + arr[2] + "." + ipi; 153 154 $.post("","action=query&ip="+ips,function(res) { 155 $("#b").css("width",b+"%"); 156 html += "<dt>"+ ips +"</dt>"; 157 for(var i in res) { 158 html += "<dd><a href=\"" + res[i] + "\" target=\"_blank\">" + res[i]+"</a></dd>"; 159 160 } 161 $("#result").append(html); 162 if(ipi<255) { 163 ipi++; 164 query(); 165 } 166 },"json"); 167 } 168 </script> 169 </html> 170 171 <?php 172 } 173 ?>
Python调用Bing进行同IP网站查询
1 #!/usr/bin/env python 2 # -*- coding: utf-8 -*- 3 # @Author: Lcy 4 # @Date: 2015-07-22 10:41:17 5 # @Last Modified by: Lcy 6 # @Last Modified time: 2015-07-22 10:49:44 7 import urllib2 8 import re 9 import sys 10 import socket 11 12 def curl(ip,first): 13 #设置ip代理， 14 proxy_handler = urllib2.ProxyHandler({"http" : 'http://115.47.46.152:1080'}) 15 null_proxy_handler = urllib2.ProxyHandler({}) 16 opener = urllib2.build_opener(proxy_handler) 17 urllib2.install_opener(opener) 18 uri = "http://www.bing.com/search?q=ip%3A" + ip +"&go=%E6%8F%90%E4%BA%A4&qs=n&first="+ str(first) +"&form=QBRE&pq=ip%3A" + ip +"&sc=0-0&sp=-1&sk=&cvid=5e52385772e24683a0bdf047de60abfc" 19 request = urllib2.Request(uri) 20 request.add_header('User-Agent', 'BaiduSpider') 21 response = urllib2.urlopen(request, timeout=10) 22 res = response.read() 23 return res 24 def getIp(domain): 25 myaddr = socket.getaddrinfo(domain,'http')[0][4][0] 26 return myaddr 27 def get(ip): 28 ip = getIp(ip) 29 print "[+] Query IP:" + ip + "\n" 30 rev = [] 31 first = 1 32 while True: 33 res = curl(ip,first) 34 first = first + 10 35 r = re.findall(r'<h2><a href="((http|https):\/\/([\w|\.]+)\/)([\w|\/|&|=|\.|\?]+)?" h="ID=\w+,\w+\.\w+">',res) 36 for i in r: 37 print "[+] " + i[0] 38 rev.append(i[0]) 39 m = re.search(r'<div class="sw_next">', res) 40 if not m: 41 break 42 result = list(set(rev)) 43 return result 44 if __name__ == "__main__": 45 print u"""------------------------------------------------------------------------------ 46 必应旁站查询 qq:1141056911 47 By Lcy 48 http://phpinfo.me 49 ------------------------------------------------------------------------------ 50 """ 51 if len(sys.argv) != 2: 52 print "Usage: %s ip" % sys.argv[0] 53 exit() 54 urllist = get(sys.argv[1]) 55 result = "" 56 for i in urllist: 57 result = result + i + "\r\n" 58 f = open("Result.txt","w") 59 f.write(result) 60 f.close() 61 print u"\r\n结果已经保存为Result.txt"
