Subdomain Scanner

The Alchemist · 02-27-2013, 02:12 PM

Hello Hack Community,

So, I've come up with another code. This is a sub domain scanner made in PHP. I don't think I need to explain to you guys why penetration testers use a tool like this. My tool is fast cause it uses multi threading.

Haven't had much time to test it but I'm quite sure it should work well.

ALL CREDITS GOES TO dataspy FOR THE LIST OF POSSIBLE SUB DOMAINS I'VE USED FOR THIS SCRIPT

There are two codes. This is the list of sub domains. Save it as subdomains.inc
The extension should be .inc

PHP Code:
<?php
$Subdomains = array(
"about",
"access",
"accounting",
"accounts",
"admin",
"administrator",
"articles",
"auth",
"authorize",
"authorized",
"backend",
"backup",
"backups",
"beta",
"billing",
"blog",
"catalog",
"chat",
"connect",
"controller",
"cpanel",
"customers",
"data",
"db",
"dbs",
"dc",
"demo",
"demostration",
"dev",
"developers",
"development",
"dir",
"directory",
"dmz",
"docs",
"domain",
"domaincontroller",
"domain-controller",
"download",
"downloads",
"edu",
"email",
"events",
"example",
"examples",
"exchange",
"extranet",
"files",
"finance",
"firewall",
"forum",
"forums",
"ftp",
"ftpd",
"gallery",
"gateway",
"groups",
"groupwise",
"guest",
"help",
"helpdesk",
"home",
"hotspot",
"images",
"imail",
"imap",
"imap3",
"imap3d",
"imapd",
"imaps",
"imgs",
"internal",
"intranet",
"irc",
"ircd",
"isa",
"it",
"jabber",
"lab",
"laboratories",
"laboratory",
"labs",
"library",
"linux",
"localhost",
"log",
"logs",
"login",
"logon",
"logs",
"mail",
"mailgate",
"manager",
"marketing",
"media",
"member",
"members",
"mercury",
"mobile",
"mssql",
"music",
"mysql",
"net",
"netmail",
"news",
"novell",
"online",
"oracle",
"partners",
"pcanywhere",
"pdf",
"personal",
"photo",
"photos",
"pic",
"pics",
"picture",
"pictures",
"pix",
"pop",
"pop3",
"p0rn",
"porn",
"p0rn0",
"porno",
"portal",
"postgresql",
"postman",
"postmaster",
"private",
"pr0n",
"pron",
"project",
"projects",
"proxy",
"pub",
"public",
"remote",
"reports",
"research",
"restricted",
"r00t",
"root",
"router",
"sales",
"sample",
"samples",
"sandbox",
"search",
"secure",
"secret",
"server",
"services",
"sex",
"sh3ll",
"shell",
"sms",
"smtp",
"solaris",
"sql",
"squirrel",
"squirrelmail",
"ssh",
"staff",
"staging",
"stats",
"status",
"su",
"sun",
"support",
"sys",
"system",
"test",
"text",
"texts",
"tftp",
"trade",
"tunnel",
"txt",
"unix",
"upload",
"uploads",
"virtual",
"vnc",
"vp",
"vpn",
"vpn1",
"vpn2",
"vpn3",
"web",
"web0",
"web01",
"web02",
"web03",
"web1",
"web2",
"web3",
"webadmin",
"weblog",
"webmail",
"webmaster",
"webmin",
"win",
"windows",
"www",
"www0",
"www01",
"www02",
"www03",
"www1",
"www2",
"www3",
"wwwdev",
"xxx"
);
?>

Here's the main code. Save it as subdomain.php

PHP Code:
<?php
set_time_limit(0);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Subdomain Scanner</title>
<style type="text/css">

  body
  {
  color: #ff;
  text-shadow: 2px 2px black;
  background-color: #282828;
  font-family: Arial, Helvetica, sans-serif;
  }

  pre
  {
  background-color: #353535;
  border: solid 1px #505050;
  }

  input
  {
  font-family: Arial, Helvetica, sans-serif;
  }

  .Button
  {
  padding: 5px 10px;
  background: #303030;
  border: solid #101010 1px;
  color: #fff;
  cursor: pointer;
  font-weight: bold;
  border-radius: 5px;
  -moz-border-radius: 5px;
  -webkit-border-radius: 5px;
  text-shadow: 1px 1px #000;
  }

  .Input
  {
  border: solid #101010 1px;
  color: white;
  font-weight: bold;
  padding: 3px;
  background-color: #252525;
  }
    </style>
</head>

<body>
<div align="center">
<pre>
  _________    ___.        .___                    .__           _________                                         
 /   _____/__ _\_ |__    __| _/____   _____ _____  |__| ____    /   _____/ ____ _____    ____   ____   ___________ 
 \_____  \|  |  \ __ \  / __ |/  _ \ /     \\__  \ |  |/    \   \_____  \_/ ___\\__  \  /    \ /    \_/ __ \_  __ \
 /        \  |  / \_\ \/ /_/ (  <_> )  Y Y  \/ __ \|  |   |  \  /        \  \___ / __ \|   |  \   |  \  ___/|  | \/
/_______  /____/|___  /\____ |\____/|__|_|  (____  /__|___|  / /_______  /\___  >____  /___|  /___|  /\___  >__|   
        \/          \/      \/            \/     \/        \/          \/     \/     \/     \/     \/     \/       
Coded By The Alchemist                                                                        www.HackCommunity.com</pre>
<br />
<br />
<?php
## Coded by The Alchemist
if(!file_exists('subdomains.inc'))
{
    echo 'Please upload the list of subdomains as <span style="color: #F00;">subdomains.inc</span>';
    exit();
}
?>
<form action="" method="POST">
Enter URL : <input type="text" class="Input" name="target" value="<?php if(isset($_POST['target']))
{echo htmlentities($_POST['target']);}?>" placeholder="http://example.com" size="50" />
<input type="submit" name="submit" class="Button" value="Scan" />
</form>
<br />
<br />
<?php
if(isset($_POST['target'],$_POST['submit']) && filter_var($_POST['target'],FILTER_VALIDATE_URL))
{
    require('subdomains.inc');
    $targ = parse_url($_POST['target']);
    $target = $targ['host'];
    $target = str_replace("www.","",$target);
    $i = 0;
    foreach($Subdomains as $val)
    {
        $url = "http://".$val.".".$target;
        $ch[$i] = curl_init($url);
        curl_setopt($ch[$i], CURLOPT_PORT, 80);
  curl_setopt($ch[$i], CURLOPT_RETURNTRANSFER, true);
        $i++;
    }
    $numberof = $i;
    $mh = curl_multi_init();
    for($i=0 ; $i < $numberof ; $i++)
    {
  curl_multi_add_handle($mh,$ch[$i]);
    }
    $null = NULL;
    try {
        curl_multi_exec($mh,$null);
    } catch(Exception $e) {
    echo "Could Not Execute";
    }
    for($i = 0 ; $i < $numberof ; $i++)
    {
  if(!curl_error($ch[$i]) && !strstr(curl_multi_getcontent($ch[$i])))
  {  
    echo '<span style="color: #F00;"> http://'.htmlentities($Subdomains[$i].".".$target).'</span> exists<br />';
  }
  curl_multi_remove_handle($mh,$ch[$i]);
  curl_close($ch[$i]);   
    }
    curl_multi_close($mh);
}
?>
</body>
</html> 

Let me know your opinion about this.
FEEDBACK WOULD BE HIGHLY APPRECIATED!!!

Deque · 02-28-2013, 06:32 AM

Useful and simple. Well done.
Maybe you should join HC Dev and create some more official tools.

The Alchemist · 02-28-2013, 04:39 PM

Sure. I'm joining HC Dev. Its such an honour. I hope I can live up to the group's reputation.

SlamberGamer · 08-02-2013, 03:13 PM

hi there... can u please this out.. i think its not working. may i know why..
http://webscanner.p.ht/subdomains.php

The Alchemist · 08-02-2013, 06:03 PM

(08-02-2013, 03:13 PM)SlamberGamer Wrote: hi there... can u please this out.. i think its not working. may i know why..
http://webscanner.p.ht/subdomains.php

Edit the code.
Look for the line that says :

Code:
set_time_limit(0);

And remove that line.

vinit.furia · 10-13-2013, 07:04 PM

script is not workin

please help it gives error

Parse error: syntax error, unexpected T_IF in /
home/u568619880/public_html/subdomain.php on
line 91

Anime_mybb_import13823 · 10-15-2013, 07:26 AM

scrpit not working

Subdomain Scanner
Author Message