平时做渗透测试我比较喜欢用lijiejie 写的 subDomainsBrute来爆破子域名
那么爆破完成后就想收集一下网站的c段信息
下面以平安为例
爆破得到子域名为
i.pingan.com.cn 183.129.178.89 www.pingan.com.cn 202.69.26.13 club.pingan.com.cn 202.69.18.234 home.pingan.com.cn 202.69.21.142 mail.pingan.com.cn 202.69.21.81 member.pingan.com.cn 202.69.26.18 resources.pingan.com.cn 202.69.26.6 b.pingan.com.cn 202.69.26.12 car.pingan.com.cn 202.69.19.184 wap.pingan.com.cn 202.69.26.16 api.pingan.com.cn 202.69.21.123 vp.pingan.com.cn 202.69.21.236 learn.pingan.com.cn 202.69.21.84 wifi.pingan.com.cn 116.31.80.134 download.pingan.com.cn 119.145.207.56, 113.107.107.15, 183.57.145.14, 113.107.57.44, 218.6.110.15, 59.56.26.227 legacy.pingan.com.cn 202.69.21.81 t.pingan.com.cn 202.69.26.20 cash.pingan.com.cn 202.69.21.176 money.pingan.com.cn 202.69.26.12 update.pingan.com.cn 210.83.237.20 citrix.pingan.com.cn 202.69.19.26 vpn.pingan.com.cn 183.63.51.72 cm.pingan.com.cn 202.69.21.64 cz.pingan.com.cn 202.69.23.155 mx1.pingan.com.cn 202.69.19.105 events.pingan.com.cn 202.69.26.57 rss.pingan.com.cn 202.69.19.41 map.pingan.com.cn 121.15.166.179 ai.pingan.com.cn 202.69.21.226 sip.pingan.com.cn 202.69.18.186, 202.69.18.183 dialin.pingan.com.cn 202.69.21.70 meet.pingan.com.cn 202.69.21.70 mx2.pingan.com.cn 202.69.19.104 localhost.pingan.com.cn 127.0.0.1 ask.pingan.com.cn 116.31.80.169 rms.pingan.com.cn 202.69.18.168 push.pingan.com.cn 202.69.21.76 ocs.pingan.com.cn 218.17.221.53 stock.pingan.com.cn 202.69.18.155 mb.pingan.com.cn 183.63.51.69 bank.pingan.com.cn 202.69.23.136 mx4.pingan.com.cn 202.69.18.86 tb.pingan.com.cn 202.69.26.19 sbc.pingan.com.cn 121.15.166.178, 58.251.11.225 recruit.pingan.com.cn 202.69.19.118 ck.pingan.com.cn 183.63.51.71 mx5.pingan.com.cn 202.69.19.217 message.pingan.com.cn 202.69.18.33 fund.pingan.com.cn 202.69.26.4 mgw.pingan.com.cn 202.69.26.46 txt.pingan.com.cn 119.145.207.55, 218.5.238.218, 183.57.144.150 pcs.pingan.com.cn 202.69.21.99 ehs.pingan.com.cn 202.69.21.172 vpn.bank.pingan.com.cn 218.17.146.201
写了一个python脚本,一个域名对应多个ip的我这里是抛弃处理
#coding=utf-8 import re from sys import argv __author__ = "depycode" def getC(ipList): resiplist = [] for i in ipList: if i.startswith("127") or i.startswith("192.168") or i.startswith("10.") or i.startswith("172"): continue else: ip = re.match(r"\d+\.\d+\.\d+\.", i) ips = ip.group(0) resiplist.append(ips) resiplist = list(set(resiplist)) return resiplist def saveC(ipList,f): for i in ipList: for j in range(1,256): f.write(i+str(j)+"\n") f.close() if __name__ == "__main__": if len(argv)!=3: print "usage:./script.py sub.txt res.txt" exit() f1 = open(argv[1],"r") f2 = open(argv[2],"w+") lis = f1.readlines() iplist = [] for i in lis: s = re.split("\s+",i) ip = s[1].strip() if len(ip)<=16: iplist.append(ip) reslist = getC(iplist) saveC(reslist, f2) print reslist print "success save to %s"% str(argv[2]) f1.close()
用法也比较简单
python test.py test.txt res.txt
结果如下