1、安装git和pip3
sudo apt update
sudo apt install git python3-pip -y
2、python虚拟环境安装
venv
为了避免依赖冲突请安装python 虚拟环境
这里提供的工具为venv
需要注意的是,venv 工具没法创建不同版本的python环境,也就是如果你用python3.5没法创建python3.6的虚拟环境。如果想要使用不同python版本的虚拟环境,请安装 virtual env包。
- 安装
sudo apt install python3-venv
- 使用
- 创建虚拟环境
sudo python3 -m venv 虚拟环境名称
- 启动虚拟环境
source 虚拟环境名称/bin/activate
- 退出虚拟环境
deactivate
virtualenv
- 安装
apt install python3-virtualenv
- 使用
- 创建虚拟环境
virtualenv 虚拟环境名称
如果存在python解释器,可以选择指定Python解释器,例如
virtualenv -p /usr/bin/python2.7 my_project_env
- 启动虚拟环境
source my_project_env/bin/activate
- 停用虚拟环境
deactivate
virtualenvwrapper
- 安装(确保virtualenv已经安装)
pip3 install virtualenvwrapper
export WORKON\_HOME=~/Envs #设置环境变量
mkdir -p $WORKON\_HOME #创建虚拟环境管理目录
find / -name virtualenvwrapper.sh #找到virtualenvwrapper.sh的路径
source 路径 #激活virtualenvwrapper.sh
- 基本使用
- 创建虚拟环境
mkvirtualenv project_env
这会在Envs 中创建 project_env虚拟环境
选择一个python解释器来搭建:
mkvirtualenv env --python=python2.7
- 在虚拟环境上工作
workon project_env
或者,您可以创建一个项目,它会创建虚拟环境,并在 $WORKON_HOME
中创建一个项目目录。 当您使用 workon project_env
时,会 cd -ed
到项目目录中。
mkvirtualenv project_env
virtualenvwrapper
提供环境名字的tab补全功能。当您有很多环境, 并且很难记住它们的名字时,这就显得很有用。
workon
也能停止您当前所在的环境,所以您可以在环境之间快速的切换。
- 停止虚拟环境
deactivate
- 删除
rmvirtualenv project_env
这里只是简要介绍有关工具的使用方式,更详细的信息各位读者可以自行在互联网上查阅,更专业也更具体。
下载地址
克隆OneForAll项目,和上面一下镜像的为gitee,有条件的可以选GitHub,二选一个
github:
sudo git clone https://github.com/shmilylty/OneForAll.git
gitee:
sudo git clone https://gitee.com/shmilylty/OneForAll.git
报错处理
对于高版本的python,在执行OneForall安装文件时会出现报错,下面提供一种解决方式,目前本人测试在自己的环境中可以解决,但对于读者的配置环境存在无法解决的可能。
1、克隆OneForall
┌──(hunter㉿hunter)-[/Tools/1_信息搜集/2_子域名收集]
└─$ sudo git clone https://github.com/shmilylty/OneForAll.git
正克隆到 'OneForAll'...
remote: Enumerating objects: 11794, done.
remote: Counting objects: 100% (501/501), done.
remote: Compressing objects: 100% (217/217), done.
remote: Total 11794 (delta 293), reused 420 (delta 276), pack-reused 11293
接收对象中: 100% (11794/11794), 105.47 MiB | 15.49 MiB/s, 完成.
处理 delta 中: 100% (6846/6846), 完成.
┌──(hunter㉿hunter)-[/Tools/1_信息搜集/2_子域名收集]
└─$ ls
2_subfinder OneForAll
┌──(hunter㉿hunter)-[/Tools/1_信息搜集/2_子域名收集]
└─$ sudo mv OneForAll 1_OneForAll
2、创建虚拟环境
┌──(hunter㉿hunter)-[/Tools/1_信息搜集/2_子域名收集]
└─$ ls
1_OneForAll 2_subfinder
┌──(hunter㉿hunter)-[/Tools/1_信息搜集/2_子域名收集]
└─$ cd 1_OneForAll
┌──(hunter㉿hunter)-[/Tools/1_信息搜集/2_子域名收集/1_OneForAll]
└─$ sudo python3 -m venv Env
[sudo] hunter 的密码:
┌──(hunter㉿hunter)-[/Tools/1_信息搜集/2_子域名收集/1_OneForAll]
└─$ ls
brute.py Dockerfile images Pipfile takeover.py
common docs LICENSE Pipfile.lock test.py
config Env modules README.md thirdparty
data export.py oneforall.py requirements.txt
3、启动虚拟环境&&安装OneForAll
注:请在已经下载的OneForAll目录下创建虚拟环境,避免出现调用时引用依赖错误。另外请先进入root环境。
┌──(hunter㉿hunter)-[/Tools/1_信息搜集/2_子域名收集/1_OneForAll]
└─$ sudo su
┌──(root㉿hunter)-[/Tools/1_信息搜集/2_子域名收集/1_OneForAll]
└─# source Env/bin/activate
┌──(Env)─(root㉿hunter)-[/Tools/1_信息搜集/2_子域名收集/1_OneForAll]
└─# ls
brute.py Dockerfile images Pipfile takeover.py
common docs LICENSE Pipfile.lock test.py
config Env modules README.md thirdparty
data export.py oneforall.py requirements.txt
┌──(Env)─(root㉿hunter)-[/Tools/1_信息搜集/2_子域名收集/1_OneForAll]
└─# pip3 install -r requirements.txt
Collecting beautifulsoup4==4.11.1 (from -r requirements.txt (line 1))
Using cached beautifulsoup4-4.11.1-py3-none-any.whl (128 kB)
Collecting bs4==0.0.1 (from -r requirements.txt (line 2))
Using cached bs4-0.0.1-py3-none-any.whl
Collecting certifi==2022.06.15 (from -r requirements.txt (line 3))
Using cached certifi-2022.6.15-py3-none-any.whl (160 kB)
Collecting chardet==5.0.0 (from -r requirements.txt (line 4))
Using cached chardet-5.0.0-py3-none-any.whl (193 kB)
Collecting colorama==0.4.4 (from -r requirements.txt (line 5))
Using cached colorama-0.4.4-py2.py3-none-any.whl (16 kB)
Collecting dnspython==2.2.1 (from -r requirements.txt (line 6))
Using cached dnspython-2.2.1-py3-none-any.whl (269 kB)
Collecting exrex==0.10.5 (from -r requirements.txt (line 7))
Using cached exrex-0.10.5-py3-none-any.whl
Collecting fire==0.4.0 (from -r requirements.txt (line 8))
Using cached fire-0.4.0-py2.py3-none-any.whl
Collecting future==0.18.2 (from -r requirements.txt (line 9))
Using cached future-0.18.2-py3-none-any.whl
Collecting idna==3.3 (from -r requirements.txt (line 10))
Using cached idna-3.3-py3-none-any.whl (61 kB)
Collecting loguru==0.6.0 (from -r requirements.txt (line 11))
Using cached loguru-0.6.0-py3-none-any.whl (58 kB)
Collecting PySocks==1.7.1 (from -r requirements.txt (line 12))
Using cached PySocks-1.7.1-py3-none-any.whl (16 kB)
Collecting requests==2.28.1 (from -r requirements.txt (line 13))
Using cached requests-2.28.1-py3-none-any.whl (62 kB)
Collecting six==1.16.0 (from -r requirements.txt (line 14))
Using cached six-1.16.0-py2.py3-none-any.whl (11 kB)
Collecting soupsieve==2.3.2 (from -r requirements.txt (line 15))
Using cached soupsieve-2.3.2-py3-none-any.whl (37 kB)
Collecting SQLAlchemy==1.3.22 (from -r requirements.txt (line 16))
Using cached SQLAlchemy-1.3.22-cp311-cp311-linux_x86_64.whl
Collecting tenacity==8.0.1 (from -r requirements.txt (line 17))
Using cached tenacity-8.0.1-py3-none-any.whl (24 kB)
Collecting termcolor==1.1.0 (from -r requirements.txt (line 18))
Using cached termcolor-1.1.0-py3-none-any.whl
Collecting tqdm==4.64.0 (from -r requirements.txt (line 19))
Using cached tqdm-4.64.0-py2.py3-none-any.whl (78 kB)
Collecting treelib==1.6.1 (from -r requirements.txt (line 20))
Using cached treelib-1.6.1-py3-none-any.whl
Collecting urllib3==1.26.9 (from -r requirements.txt (line 21))
Using cached urllib3-1.26.9-py2.py3-none-any.whl (138 kB)
Collecting win32-setctime==1.1.0 (from -r requirements.txt (line 22))
Using cached win32_setctime-1.1.0-py3-none-any.whl (3.6 kB)
Collecting charset-normalizer<3,>=2 (from requests==2.28.1->-r requirements.txt (line 13))
Using cached charset_normalizer-2.1.1-py3-none-any.whl (39 kB)
Installing collected packages: termcolor, exrex, win32-setctime, urllib3, tqdm, tenacity, SQLAlchemy, soupsieve, six, PySocks, loguru, idna, future, dnspython, colorama, charset-normalizer, chardet, certifi, treelib, requests, fire, beautifulsoup4, bs4
Successfully installed PySocks-1.7.1 SQLAlchemy-1.3.22 beautifulsoup4-4.11.1 bs4-0.0.1 certifi-2022.6.15 chardet-5.0.0 charset-normalizer-2.1.1 colorama-0.4.4 dnspython-2.2.1 exrex-0.10.5 fire-0.4.0 future-0.18.2 idna-3.3 loguru-0.6.0 requests-2.28.1 six-1.16.0 soupsieve-2.3.2 tenacity-8.0.1 termcolor-1.1.0 tqdm-4.64.0 treelib-1.6.1 urllib3-1.26.9 win32-setctime-1.1.0
4、测试是否异常
┌──(Env)─(root㉿hunter)-[/Tools/1_信息搜集/2_子域名收集/1_OneForAll]
└─# python3 oneforall.py --help
Traceback (most recent call last):
File "/Tools/1\_信息搜集/2\_子域名收集/1\_OneForAll/oneforall.py", line 16, in <module>
from brute import Brute
File "/Tools/1\_信息搜集/2\_子域名收集/1\_OneForAll/brute.py", line 14, in <module>
import exrex
File "/Tools/1\_信息搜集/2\_子域名收集/1\_OneForAll/Env/lib/python3.11/site-packages/exrex.py", line 25, in <module>
from re import sre_parse, U
ImportError: cannot import name 'sre\_parse' from 're' (/usr/lib/python3.11/re/__init__.py)
请先别急,这里报错是因为缺少sre_parse模块。实际上是因为高版本python中re模块没有了sre_parse模块,可以修改exrex.py 代码,直接导入sre_parse模块。
┌──(Env)─(root㉿hunter)-[/Tools/1_信息搜集/2_子域名收集/1_OneForAll]
└─# vim /Tools/1\_信息搜集/2\_子域名收集/1\_OneForAll/Env/lib/python3.11/site-packages/exrex.py
注意此处目录的路径,需要与报错路径一致。
修改exrex.py
如下:
try:
from future_builtins import map, range
except:
pass
import sre_parse
#from re import sre\_parse, U
from re import U
from itertools import tee
from random import choice, randint
from types import GeneratorType
再次运行,可以尝试以下命令
python3 oneforall.py --target baidu.com run
出现如下代表已经成功
┌──(Env)─(root㉿hunter)-[/Tools/1_信息搜集/2_子域名收集/1_OneForAll]
└─# python3 oneforall.py --target baidu.com run
OneForAll is a powerful subdomain integration tool
___ _ _
___ ___ ___| _|___ ___ ___| | | {v0.4.5 #dev}
| . | | -_| _| . | _| .'| | |
|___|_|_|___|_| |___|_| |__,|_|_| git.io/fjHT1
OneForAll is under development, please update before each use!
[*] Starting OneForAll @ 2024-01-27 21:44:00
21:44:00,894 [INFOR] utils:532 - Checking dependent environment
21:44:00,894 [INFOR] utils:544 - Checking network environment
21:44:09,437 [INFOR] utils:555 - Checking for the latest version
21:44:20,605 [INFOR] utils:579 - The current version v0.4.5 is already the latest version
21:44:20,610 [INFOR] oneforall:241 - Start running OneForAll
21:44:20,614 [INFOR] oneforall:246 - Got 1 domains
21:44:20,641 [INFOR] wildcard:108 - Detecting baidu.com use wildcard dns record or not
21:44:20,842 [ALERT] wildcard:123 - The domain baidu.com disables wildcard
21:44:20,843 [INFOR] collect:44 - Start collecting subdomains of baidu.com
21:44:20,950 [INFOR] module:63 - QueryMX module took 0.0 seconds found 0 subdomains
21:44:20,977 [INFOR] module:63 - QueryNS module took 0.0 seconds found 5 subdomains
21:44:20,983 [INFOR] module:63 - AXFRCheck module took 0.1 seconds found 0 subdomains
21:44:20,988 [INFOR] module:63 - NSECCheck module took 0.1 seconds found 0 subdomains
21:44:21,003 [INFOR] module:63 - QuerySOA module took 0.1 seconds found 2 subdomains
21:44:21,010 [INFOR] module:63 - QuerySPF module took 0.1 seconds found 0 subdomains
21:44:21,016 [INFOR] module:63 - QueryTXT module took 0.1 seconds found 4 subdomains
常用使用方式
1、您可以在OneForAll的config目录下修改有关配置
api.py
# 模块API配置
# Censys可以免费注册获取API:https://censys.io/api
censys_api_id = ''
censys_api_secret = ''
# Binaryedge可以免费注册获取API:https://app.binaryedge.io/account/api
# 免费的API有效期只有1个月,到期之后可以再次生成,每月可以查询250次。
binaryedge_api = ''
# BeVigil API: https://bevigil.com/osint-api
bevigil_api = ''
# Chinaz可以免费注册获取API:http://api.chinaz.com/ApiDetails/Alexa
chinaz_api = ''
# Bing可以免费注册获取API:https://azure.microsoft.com/zh-cn/services/
# cognitive-services/bing-web-search-api/#web-json
bing_api_id = ''
bing_api_key = ''
# SecurityTrails可以免费注册获取API:https://securitytrails.com/corp/api
securitytrails_api = ''
# https://fofa.so/api
fofa_api_email = '' # fofa用户邮箱
fofa_api_key = '' # fofa用户key
# Google可以免费注册获取API:
# 免费的API只能查询前100条结果
# https://developers.google.com/custom-search/v1/overview#search\_engine\_id
# 创建自定义搜索引擎后需要在响应的控制面板上启用Search the entire web
google_api_id = '' # Google API自定义搜索引擎id
# https://developers.google.com/custom-search/v1/overview#api\_key
google_api_key = '' # Google API自定义搜索key
# https://api.passivetotal.org/api/docs/
riskiq_api_username = ''
riskiq_api_key = ''
# Shodan可以免费注册获取API: https://account.shodan.io/register
# 免费的API限速1秒查询1次
shodan_api_key = ''
# ThreatBook API 查询子域名需要收费 https://x.threatbook.cn/nodev4/vb4/myAPI
threatbook_api_key = ''
# VirusTotal可以免费注册获取API: https://developers.virustotal.com/reference
virustotal_api_key = ''
# https://www.zoomeye.org/doc?channel=api
zoomeye_api_key = ''
# Spyse可以免费注册获取API: https://spyse.com/
spyse_api_token = ''
# https://www.circl.lu/services/passive-dns/
circl_api_username = ''
circl_api_password = ''
# https://www.dnsdb.info/
dnsdb_api_key = ''
# ipv4info可以免费注册获取API: http://ipv4info.com/tools/api/
# 免费的API有效期只有2天,到期之后可以再次生成,每天可以查询50次。
ipv4info_api_key = ''
# https://github.com/360netlab/flint
# passivedns\_api\_addr默认空使用http://api.passivedns.cn
# passivedns\_api\_token可为空
passivedns_api_addr = ''
passivedns_api_token = ''
# Github Token可以访问https://github.com/settings/tokens生成,user为Github用户名
# 用于子域接管和子域收集
github_api_user = ''
github_api_token = ''
# obtain Cloudflare API key from https://dash.cloudflare.com/profile/api-tokens
cloudflare_api_token = ''
# https://hunter.qianxin.com/home/userInfo
hunter_api_key = ''
# https://api-docs.fullhunt.io/
fullhunt_api_key = ''
# 登录quake之后可在个人中心获取key https://quake.360.net/quake/#/personal?tab=message
quake_api_key = ''
#https://www.racent.com/ctlog F2>Network抓包获取Token
racent_api_token = ''
default.py
# coding=utf-8
"""
OneForAll默认配置
"""
import pathlib
import warnings
# 禁用所有警告信息
warnings.filterwarnings("ignore")
# 路径设置
relative_directory = pathlib.Path(__file__).parent.parent # OneForAll代码相对路径
module_dir = relative_directory.joinpath('modules') # OneForAll模块目录
third_party_dir = relative_directory.joinpath('thirdparty') # 三方工具目录
data_storage_dir = relative_directory.joinpath('data') # 数据存放目录
result_save_dir = relative_directory.joinpath('results') # 结果保存目录
temp_save_dir = result_save_dir.joinpath('temp')
# OneForAll入口参数设置
enable_check_network = True # 开启网络环境检查
enable_check_version = True # 开启最新版本检查
enable_brute_module = True # 使用爆破模块(默认True)
enable_dns_resolve = True # 使用DNS解析子域(默认True)
enable_http_request = True # 使用HTTP请求子域(默认True)
enable_finder_module = True # 开启finder模块,开启会从响应体和JS中再次发现子域(默认True)
enable_altdns_module = True # 开启altdns模块,开启会利用置换技术重组子域再次发现新子域(默认True)
enable_enrich_module = True # 开启enrich模块,开启会富化出信息,如ip的cdn,cidr,asn,org,addr和isp等信息
enable_banner_identify = True # 开启WEB指纹识别模块(默认True)
enable_takeover_check = False # 开启子域接管风险检查(默认False)
# 参数可选值有 'small', 'medium', 'large'
http_request_port = 'small' # HTTP请求子域(默认 'small',探测80,443端口)
# 参数可选值True,False分别表示导出存活,全部子域结果
result_export_alive = True # 只导出存活的子域结果(默认False)
# 参数可选格式有 'csv', 'json'
result_save_format = 'csv' # 子域结果保存文件格式(默认csv)
# 参数path默认None使用OneForAll结果目录自动生成路径
result_save_path = None # 子域结果保存文件路径(默认None)
**网上学习资料一大堆,但如果学到的知识不成体系,遇到问题时只是浅尝辄止,不再深入研究,那么很难做到真正的技术提升。**
**[需要这份系统化的资料的朋友,可以点击这里获取!](https://bbs.csdn.net/topics/618542503)**
**一个人可以走的很快,但一群人才能走的更远!不论你是正从事IT行业的老鸟或是对IT行业感兴趣的新人,都欢迎加入我们的的圈子(技术交流、学习资源、职场吐槽、大厂内推、面试辅导),让我们一起学习成长!**