Git Product home page Git Product logo

vita's Introduction

Vita

release Build status

Vita is a tool to gather subdomains from passive sources much like tomnomnom's assetfinder.

Installation

Precompiled binaries for vita are available in the releases tab. Just pick your platform and extract the archive that contains the binary.

Building it yourself

If you want to build it yourself you will need to install Rust, you can get the official installation from the Rust website.

To build Vita:

$ git clone https://github.com/junnlikestea/vita
$ cd vita
$ cargo build --release
$ ./target/release/vita --version

Usage

With a single domain and collecting data from free sources

vita -d hackerone.com

By default the results will be unique, and will filter subdomains not related to your root domain, or domains if you choose to supply multiple.

Collecting data only on a specific subdomain

If you only want to collect results related to a specific subdomain you can use the --subs-only flag. This will cause vita to run on the actual domain and not the root domain. Results will be filtered to anything that ends with the input domain or domains.

vita -d api.hackerone.com --subs-only

With a list of domains from a file

vita -f path/to/domains.txt

With a list of domains from stdin

vita < /path/to/domains.txt

Outputting results as they're received

You can output results as they arrive as opposed to once all sources finish using the --flush flag. You might want to use this flag when you're running vita on a small vps without much memory. When this flag is active vita will not remove duplicates, so you may want to pipe it through something like sort -u.

vita -d hackerone.com --flush

Collecting data using paid sources

If you want to include sources which require API keys, add the -a or -all flag, for example:

vita -d hackerone.com -a

By default it will just ignore services you don't supply keys for.

Excluding sources

You can exclude sources with the -e flag

vita -d hackerone.com -e Wayback

If you would like some more verbose output you can use the -v flag. There are different levels of verbosity ranging from noisy to informational, most of the time I just use info. This is all printing to stderr, so it won't be captured in the results.

  • info: General information like how many results each source returned.
  • debug: Lots and lots of information about what's going on under the hood.
vita -d hackerone.com -v info

Common error - Too many open files

Vita uses async concurrent http requests under the hood. If you encounter an error similar to "Too many open files" it means that there isn't enough available file descriptors on your system. You can fix this by increasing the hard and soft limits. There are lots of different guides available to increase the limits but here is one for linux.

Sources

  • SonarSearch
  • C99
  • ProjectDiscovery Chaos
  • AnubisDB
  • Alienvault
  • Binaryedge
  • Certspotter
  • Crt.sh
  • Hackertarget
  • Threatcrowd
  • VirusTotal
  • Sublis3r
  • Security Trails
  • Spyse
  • Urlscan.io
  • Facebook
  • Threatminer
  • Wayback Machine
  • IntelligenceX
  • PassiveTotal

How to set your Api Keys

Add a .env file to the tool directory or add the following to your existing .env file:

  • Binaryedge:
    • Needs BINARYEDGE_TOKEN set
  • ProjectDiscovery Chaos
    • Needs CHAOS_KEY set
  • Facebook:
    • Needs FB_APP_ID and FB_APP_SECRET set.
  • Spyse:
    • Needs SPYSE_TOKEN set.
  • Security Trails:
    • Needs SECURITY_TRAILS_KEY set.
  • C99:
    • Needs C99_KEY set.
  • PassiveTotal:
    • Needs PASSIVETOTAL_KEY and PASSIVETOTAL_SECRET set
    • Can be found under the account settings page.
  • IntelligenceX:
    • Needs INTELX_KEY and INTELX_URL to be set
    • Can be found under the developer tab

If you hit rate limits or authentication fails, the source will just be ignored from the list of potential sources.

A note on tuning the concurrency

Currently Vita will limit the search for data to 200 root domains concurrently. If you would like to change that limit you can use the -c flag:

vita -f /path/to/roots.txt -c 400

Thanks

0xatul For constant feedback and improvement ideas.

dee-see For the contributions and neat issues!

TomNomNom For inspiring me to write and release open source tools.

Cgboal For SonarSearch which is a data source for Vita.

ProjectDiscovery For Chaos which is a great data source.

Thanks to all the data source providers, and everyone else I can't seem to remember at this point in time. I'll make sure to add you in the future.

To-do

  • Add more paid sources.
  • Write some documentation for the underlying library that Vita uses, and prepare publish to crates.io.
  • Clean up types and optimise performance further.

Disclaimer

Developers have/has no responsibility or authority over any kind of:

  • Legal or Law infringement by third parties and users.
  • Malicious use capable of causing damage to third parties.
  • Illegal or unlawful use of vita.

vita's People

Contributors

0xatul avatar 0xflotus avatar dee-see avatar junnlikestea avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

vita's Issues

Add a flag for connection timeout

Being able to specify connection timeout gives the user the ability to skip sources which take a longer amount of time to return results. For example, Wayback Archive

Increase RegexSetBuilder size limits.

Currently if you pass in a large number of root domains(~7000) into vita, the compiled regex exceeds the size limits and causes a panic.

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: CompiledTooBig(10485760)', src/bin/main.rs:36:23
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

To fix this we should add an increase to that size limit using:
https://docs.rs/regex/1.3.9/regex/struct.RegexSetBuilder.html#method.size_limit

Update AnubisDB to handle `Option<None>` value

Some changes have been made to the AnubisDB API that is causing a panic on the handling of the response. This can be triggered by passing in a domain which AnubisDB has no results for.

thread 'tokio-runtime-worker' panicked at 'called `Option::unwrap()` on a `None` value', src/sources/anubisdb.rs:20:9

Fix Panic on BinaryEdge

Vita currently panics if the binaryedge API returns 401 unauthorised, fix it to handle the error not panic.

Ensure output filters subdomains correctly.

Make sure the enumeration results filter domains which would be considered out of scope. For example, if given the domain example.com currently the output would contain subdomains which include other country extensions:

somesubdomain.example.com.au
somesubdomain.example.com

but the desired output would be:

somesubdomain.example.com

The reason we want to apply this fix is due to program scopes. We don't want to include subdomains in the results which would be out of scope. For example, given the root domain: example.com as in scope, but the domain example.com.au as out of scope. Therefore, we wouldn't want to include those in the output.

Fix panic on handling response data from tls.bufferover.run

Currently if we receive an item in the response which doesn't match the length of the majority of the other responses, it would cause a panic because the index would be out of bounds.

.map(|s| s.split(',').collect::<Vec<&str>>()[2].to_owned())

thread 'async-std/runtime' panicked at 'index out of bounds: the len is 2 but the index is 2', src/sources/bufferover.rs:38:17

Add connection timeouts

In the previous version we had no connection timeouts which would cause vita, in some instances to run infidelity and never finish.

Fix Tokio panics on unset environment variables

thread 'tokio-runtime-worker' panicked at 'BINARYEDGE_TOKEN must be set in order to use Binaryedge as a data source: NotPresent

Async-std didn't cause a panic if the environment variables were not set, but tokio does.

Add a flag to tune the concurrency threshold

vita/src/lib.rs

Line 109 in 2b237cf

const ACTIVE_REQUESTS: usize = 200;

Currently we use a hardcoded value to limit how many domains we can fetch data for at one time, but I feel like the user should have control of this value. For example, if I have a list of root domains which has over 10k entries, having a hardcoded value setting the limit to 200 might be capping me for no reason.

Instead we should add a flag with a default value set to something reasonable.

Flush results to output as they are fetched

Currently the tool fetches all subdomains and at the end prints them all to stdout. When running again targets with very large amounts of subdomains, this allocates a very large vector for subdomains before calling cleaner.clean(subdomains). This is made worse by the fact that I'm running Vita on a 2 GB VPS which simply can't handle it and crashes.

vita -d comcast.net results in memory allocation of 1610612736 bytes failed I don't know if there's something going wrong with the error message, but that's quite a bit of memory!

Flushing results to output as they are fetched would solve that, however it might make it difficult to output only unique results. Personally I wouldn't mind a --flush switch that outputs duplicated results.

Remove the logic for reading credentials from env out of the run methods

let api_key = match env::var("BINARYEDGE_TOKEN") {
Ok(key) => key,
Err(_) => return Err(Error::key_error("binaryedge")),
};

Instead of implementing this inside the run methods, we should instead make a struct and implement a method to read the credentials from environment variables. For example:

struct Creds {
  token: String,
}

impl Creds {
   pub fn read_env() -> Result<Self> {
      // returns credentials or errors
   }
}

Add a flag for debugging info

Add a flag that enables the user to print useful information for debugging purposes or just because they're interested.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.