[hunt3r972]

This is a script to list all the alive hosts on a domain. It will not work if it can't find the DNS !!

Code:

#!/bin/bash echo echo ' ______ _______ _______ _______ _________ _ _______ _______ _______ _ _ _______ _______ ' echo '( __ \ ( ___ )( )( ___ )\__ __/( ( /|( ____ \( ____ \( ___ )( ( /|( ( /|( ____ \( ____ )' echo '| ( \ )| ( ) || () () || ( ) | ) ( | \ ( || ( \/| ( \/| ( ) || \ ( || \ ( || ( \/| ( )|' echo '| | ) || | | || || || || (___) | | | | \ | || (_____ | | | (___) || \ | || \ | || (__ | (____)|' echo '| | | || | | || |(_)| || ___ | | | | (\ \) |(_____ )| | | ___ || (\ \) || (\ \) || __) | __)' echo '| | ) || | | || | | || ( ) | | | | | \ | ) || | | ( ) || | \ || | \ || ( | (\ ( ' echo '| (__/ )| (___) || ) ( || ) ( |___) (___| ) \ |/\____) || (____/\| ) ( || ) \ || ) \ || (____/\| ) \ \__' echo '(______/ (_______)|/ \||/ \|\_______/|/ )_)\_______)(_______/|/ \||/ )_)|/ )_)(_______/|/ \__/' echo echo "By 9H4C7K3R2 - v1.0" echo "@ Script to list all alive hosts on a domain" echo # List sub domain and gives IP addresses echo -n "[+] Website URL (ex: www.google.com): " read url while [[ $url == "" ]] # Testing if a website has been entered do echo -n "[+] Website URL (ex: www.google.com): " read url done domaine=$(echo $url | sed -r 's/.*\.([^.]+\.[^.]+)$/\1/') # Picking domain echo "[+] Searching Domain" # Grabbing DNS dns=$(whois $domaine | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed '1d') if [[ -z ${dns} ]] then echo "[+] Impossible to find DNS ip address or domain" echo "[+] Exiting" exit fi whois $domaine | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed '1d' > .dns echo "[+] Grabbing DNS on domain $domaine" i=1 dnsnb=$(wc -l .dns | sed -e 's/\.dns//') # Counting DNS # Grabbing sub-domains while ((i<=dnsnb)) do dns=$(cat .dns | sed -n "$i"p"") host -l $domaine $dns >> .fetchdomain ((i++)) done echo "[+] Searching sub-domains" # Taking IP addresses and deleting doubles cat .fetchdomain | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' > .allipadd sort .allipadd | uniq > .ipdomain echo "[+] Grabbing IP addresses and cleaning list" j=1 ipnb=$(wc -l .ipdomain | sed -e 's/\.ipdomain//') # Counting number of found IP address # Ping Test and Printing results echo "[+] Checking alive hosts - $ipnb IPs" sleep 3 echo "[+] Result:" while ((j<=ipnb)) do ip=$(cat .ipdomain | sed -n "$j"p"") ping -c 1 -W 1 $ip > .testip result=$(cat .testip | grep -E -o '[0-9]{1,3}\% packet loss') if [[ $result == "0% packet loss" ]] then echo "IP address $ip answered and belongs to domain $url" else cat .testip 2>&1 >/dev/null fi ((j++)) done rm .dns rm .fetchdomain rm .allipadd rm .ipdomain rm .testip