esc4icescesc / skanuvaty Goto Github PK

Rather than writing the output at once, we should provide a argument for streaming output to a file. Useful for piping skanuvaty into other tools, but also in case something goes wrong along the scan (like #8)

DNS lookups sometimes timeout, especially if you query a lot of hostnames with a lot of concurrency. We should make this configurable.

./build.sh
./build.sh: line 6: cross: command not found

Instead of just scanning for $SUBDOMAIN.$ROOTDOMAIN, for each $SUBDOMAIN we can resolve, we should repeat the bruteforce, in order to find subdomains within that one.

When I set the target and run that script, then I found the error!! what is the issue?

Sometimes you don't want to run the full scan, or something went wrong with your network connection while you run the scan, and at that point you loose all the results.

We could provide a flag (--output-found) that prints each found subdomain as we come across them.

nisha@Nishant:/mnt/c/Users/nisha/Downloads/skanuvaty-master$ skanuvaty --target google.com --dns-resolver 10.64.0.1:53 --concurrency 16 --subdomains-file dns.txt
######################
### Target: "google.com"
### DNS resolver: 10.64.0.1:53
### Concurrency: 16
### Subdomains File: "dns.txt"
### Output File: "./skanuvaty.output.json"
### Verbose: false
######################
⠁ [00:00:00] [==============================] 0/0 (0s) (Found: )
######################
### Found subdomains: 0
  [00:00:00] [==============================] 0/0 (0s) (Found: 0)
Domain didn't have any addresses
RootDomain {
    name: "google.com",
    subdomains: [],
    addresses: [],
}

Add a proper guide please.

We should do a search in certificate transparency logs before doing the bruteforce search, would be something like this:

curl "https://crt.sh?q=nmap.org&output=json" | jq ".[].common_name"

Seems crt.sh is having sometimes some uptime problems, sometimes we get 502 Bad Gateway errors from it. So should try at least 5 times with exponential backoff before giving up.

We should start each scan by scanning 10 subdomains with random characters, and if all of those resolves, assume there is wildcard subdomain setup and abort the scan. Should be overridable by user parameter too.