mirror of
https://github.com/Jieyab89/OSINT-Cheat-sheet.git
synced 2026-07-28 14:47:03 -07:00
527 lines
16 KiB
Python
527 lines
16 KiB
Python
#!/usr/bin/env python3
|
|
"""
|
|
Domain TLD Enumerator
|
|
======================
|
|
Example:
|
|
python3 domain_tld_enum.py --name contohbrand
|
|
python3 domain_tld_enum.py --name contohbrand --tlds com,id,su,st,cx
|
|
python3 domain_tld_enum.py --name contohbrand --brute --brute-max-len 3
|
|
python3 domain_tld_enum.py --name contohbrand --brute --no-common --brute-max-len 2
|
|
"""
|
|
import argparse
|
|
import concurrent.futures
|
|
import itertools
|
|
import json
|
|
import re
|
|
import socket
|
|
import string
|
|
import sys
|
|
import time
|
|
import requests
|
|
import dns.resolver
|
|
try:
|
|
from shutil import get_terminal_size
|
|
except ImportError:
|
|
get_terminal_size = None
|
|
requests.packages.urllib3.disable_warnings()
|
|
DEFAULT_TIMEOUT = 6
|
|
USER_AGENT = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240"
|
|
class Colors:
|
|
GREEN = "\033[92m"
|
|
RED = "\033[91m"
|
|
YELLOW = "\033[93m"
|
|
BOLD = "\033[1m"
|
|
RESET = "\033[0m"
|
|
@staticmethod
|
|
def disable():
|
|
Colors.GREEN = Colors.RED = Colors.YELLOW = Colors.BOLD = Colors.RESET = ""
|
|
def green(text):
|
|
return f"{Colors.GREEN}{text}{Colors.RESET}"
|
|
# Wordlist (TLD + ccTLD + gTLD + vanity)
|
|
COMMON_TLDS = [
|
|
|
|
# Core
|
|
"com","net","org","info","biz","name","pro",
|
|
|
|
# Startup
|
|
"io","ai","app","dev","tech","cloud",
|
|
"software","systems","digital","network",
|
|
"security","email","tools",
|
|
|
|
# Business
|
|
"company","business","finance","capital",
|
|
"ventures","partners","consulting",
|
|
"solutions","services","support",
|
|
|
|
# Content
|
|
"blog","news","media","press",
|
|
"wiki","community","forum",
|
|
|
|
# Commerce
|
|
"shop","store","market","shopping",
|
|
"sale","deals",
|
|
|
|
# Branding
|
|
"xyz","online","site","website",
|
|
"space","world","live","today",
|
|
"agency","studio","design",
|
|
"group","life","center","zone",
|
|
|
|
# Indonesia
|
|
"id","co.id","web.id","or.id",
|
|
"ac.id","sch.id","go.id","my.id",
|
|
|
|
# Asia
|
|
"sg","my","th","vn","ph","in",
|
|
"jp","kr","cn","tw","hk",
|
|
|
|
# Europe
|
|
"uk","co.uk","de","fr","nl",
|
|
"it","es","pt","pl","ru",
|
|
"se","no","fi","dk","ch",
|
|
"at","be","cz","ro","hu",
|
|
"sk","si","bg","ua",
|
|
|
|
# Americas
|
|
"us","ca","mx","br","ar",
|
|
|
|
# Oceania
|
|
"au","nz",
|
|
|
|
# Middle East
|
|
"ae","sa","qa","tr",
|
|
|
|
# Vanity
|
|
"cc","tv","gg","vc","me",
|
|
"fm","am","ws","to","sh",
|
|
"is","ly","la","so","im",
|
|
"bz","li","sc","ms","gd",
|
|
"top","vip","icu","monster",
|
|
"buzz","click","link","win",
|
|
"fun","quest","su","st","cx",
|
|
"ax","gd","im","li","as","bz",
|
|
"sc","tk","ml","ga","cf","gq",
|
|
"nu","so","ms","re","wf","tf",
|
|
"pm","yt","nf","hn",
|
|
|
|
# Additional modern gTLD
|
|
"team", "global", "care", "social",
|
|
"video", "chat", "academy", "training",
|
|
"events", "marketing", "exchange",
|
|
"international", "technology",
|
|
|
|
]
|
|
def generate_brute_tlds(max_len=3, min_len=1):
|
|
"""
|
|
Generate a-z string combinations with lengths ranging from min_len to max_len.
|
|
WARNING:
|
|
The number of combinations grows exponentially (26^n).
|
|
Avoid setting max_len too high (>4) unless you are prepared for
|
|
long execution times and possible DNS rate limiting.
|
|
len 1 -> 26
|
|
len 2 -> 676
|
|
len 3 -> 17,576
|
|
len 4 -> 456,976
|
|
len 5 -> 11,881,376
|
|
"""
|
|
letters = string.ascii_lowercase
|
|
for length in range(min_len, max_len + 1):
|
|
for combo in itertools.product(letters, repeat=length):
|
|
yield "".join(combo)
|
|
def build_tld_list(args):
|
|
"""
|
|
Build the TLD list according to the following priority order:
|
|
1. Custom TLDs provided via --tlds (if specified)
|
|
2. Common TLDs (unless --no-common is enabled)
|
|
3. Brute-force generated a-z combinations (if --brute is enabled)
|
|
The order is preserved to ensure that commonly used and
|
|
high-value TLDs are processed first, followed by brute-force
|
|
generated candidates.
|
|
"""
|
|
tlds = []
|
|
if args.tlds:
|
|
tlds.extend([t.strip().lstrip(".") for t in args.tlds.split(",") if t.strip()])
|
|
if not args.no_common:
|
|
tlds.extend(COMMON_TLDS)
|
|
if args.brute:
|
|
brute_list = list(generate_brute_tlds(max_len=args.brute_max_len, min_len=args.brute_min_len))
|
|
tlds.extend(brute_list)
|
|
# dedupe, keep order (common tetap di depan, brute di belakang)
|
|
seen = set()
|
|
final = []
|
|
for t in tlds:
|
|
if t not in seen:
|
|
seen.add(t)
|
|
final.append(t)
|
|
return final
|
|
def resolve_dns(domain):
|
|
"""Resolve A record. Return list IP or None"""
|
|
try:
|
|
answers = dns.resolver.resolve(domain, "A", lifetime=DEFAULT_TIMEOUT)
|
|
return [str(r) for r in answers]
|
|
except Exception:
|
|
# fallback ke socket sebagai cadangan resolver
|
|
try:
|
|
ip = socket.gethostbyname(domain)
|
|
return [ip]
|
|
except Exception:
|
|
return None
|
|
def resolve_ns(domain):
|
|
"""Resolve NS record. Return list nameserver or None."""
|
|
try:
|
|
answers = dns.resolver.resolve(domain, "NS", lifetime=DEFAULT_TIMEOUT)
|
|
return [str(r).rstrip(".") for r in answers]
|
|
except Exception:
|
|
return None
|
|
def extract_title(html_text):
|
|
if not html_text:
|
|
return None
|
|
match = re.search(r"<title[^>]*>(.*?)</title>", html_text, re.IGNORECASE | re.DOTALL)
|
|
if match:
|
|
title = re.sub(r"\s+", " ", match.group(1)).strip()
|
|
return title[:200] if title else None
|
|
return None
|
|
def check_http(url):
|
|
"""Request HTTP(S), return dict info"""
|
|
try:
|
|
resp = requests.get(
|
|
url,
|
|
timeout=DEFAULT_TIMEOUT,
|
|
headers={"User-Agent": USER_AGENT},
|
|
allow_redirects=True,
|
|
verify=False,
|
|
)
|
|
return {
|
|
"status_code": resp.status_code,
|
|
"length": len(resp.content),
|
|
"title": extract_title(resp.text),
|
|
"server": resp.headers.get("Server"),
|
|
"content_type": resp.headers.get("Content-Type"),
|
|
"final_url": resp.url,
|
|
"redirected": resp.url != url,
|
|
}
|
|
except requests.exceptions.SSLError:
|
|
return {"error": "ssl_error"}
|
|
except requests.exceptions.ConnectTimeout:
|
|
return {"error": "connect_timeout"}
|
|
except requests.exceptions.ConnectionError:
|
|
return {"error": "connection_error"}
|
|
except requests.exceptions.RequestException as e:
|
|
return {"error": str(e)[:120]}
|
|
def enumerate_one(name, tld):
|
|
domain = f"{name}.{tld}"
|
|
result = {
|
|
"domain": domain,
|
|
"tld": tld,
|
|
"resolved": False,
|
|
"ip": None,
|
|
"ns": None,
|
|
"http": None,
|
|
"https": None,
|
|
}
|
|
ips = resolve_dns(domain)
|
|
ns_records = resolve_ns(domain)
|
|
result["ns"] = ns_records
|
|
if ips or ns_records:
|
|
result["resolved"] = True
|
|
result["available_guess"] = False
|
|
else:
|
|
result["available_guess"] = True
|
|
|
|
if not ips:
|
|
return result
|
|
result["ip"] = ips
|
|
|
|
https_info = check_http(f"https://{domain}")
|
|
result["https"] = https_info
|
|
http_info = check_http(f"http://{domain}")
|
|
result["http"] = http_info
|
|
return result
|
|
def truncate(text, width):
|
|
if text is None:
|
|
return "-"
|
|
text = str(text)
|
|
if len(text) <= width:
|
|
return text
|
|
return text[: width - 1] + "…"
|
|
def get_combined_status(result):
|
|
|
|
parts = []
|
|
for scheme in ("https", "http"):
|
|
info = result.get(scheme)
|
|
if info is None:
|
|
continue
|
|
if "status_code" in info:
|
|
parts.append(f"{scheme[0].upper()}:{info['status_code']}")
|
|
elif "error" in info:
|
|
parts.append(f"{scheme[0].upper()}:ERR")
|
|
return ", ".join(parts) if parts else "-"
|
|
def get_combined_title(result):
|
|
for scheme in ("https", "http"):
|
|
info = result.get(scheme)
|
|
if info and info.get("title"):
|
|
return info["title"]
|
|
return None
|
|
def get_combined_length(result):
|
|
for scheme in ("https", "http"):
|
|
info = result.get(scheme)
|
|
if info and "length" in info:
|
|
return info["length"]
|
|
return None
|
|
def get_https_service(result):
|
|
info = result.get("https")
|
|
if info is None:
|
|
return "-"
|
|
if "status_code" in info:
|
|
return f"yes ({info['status_code']})"
|
|
if "error" in info:
|
|
return f"no ({info['error']})"
|
|
return "-"
|
|
def has_status_200(result):
|
|
|
|
for scheme in ("https", "http"):
|
|
info = result.get(scheme)
|
|
if info and info.get("status_code") == 200:
|
|
return True
|
|
return False
|
|
def colorize_status(code_str, has_200):
|
|
if has_200:
|
|
return green(code_str)
|
|
return code_str
|
|
def print_table(results, use_color=True):
|
|
|
|
headers = ["ID", "DOMAIN", "TLD", "HTTP/HTTPS CODE", "TITLE", "NS", "DNS", "HTTPS", "LENGTH"]
|
|
widths = [4, 28, 8, 18, 26, 22, 8, 14, 8]
|
|
def fmt_row(cells, colors=None):
|
|
out = []
|
|
for i, (c, w) in enumerate(zip(cells, widths)):
|
|
text = truncate(c, w).ljust(w)
|
|
if colors and colors.get(i):
|
|
# pad dulu baru kasih warna, supaya alignment tetap rapi
|
|
text = colors[i](truncate(c, w)) + " " * (w - len(truncate(c, w)))
|
|
out.append(text)
|
|
return " | ".join(out)
|
|
sep = "-+-".join("-" * w for w in widths)
|
|
print(fmt_row(headers))
|
|
print(sep)
|
|
for idx, r in enumerate(results, start=1):
|
|
domain = r["domain"]
|
|
tld = r["tld"]
|
|
code = get_combined_status(r)
|
|
title = get_combined_title(r)
|
|
ns_list = r.get("ns")
|
|
ns_str = ns_list[0] if ns_list else "-"
|
|
if ns_list and len(ns_list) > 1:
|
|
ns_str += f" (+{len(ns_list)-1})"
|
|
is_up = r.get("resolved")
|
|
dns_status = "UP" if is_up else "down"
|
|
https_status = get_https_service(r)
|
|
length = get_combined_length(r)
|
|
has_200 = has_status_200(r)
|
|
if use_color:
|
|
colors = {}
|
|
if has_200:
|
|
colors[3] = green # HTTP/HTTPS CODE
|
|
if is_up:
|
|
colors[6] = green # DNS
|
|
print(fmt_row([str(idx), domain, tld, code, title, ns_str, dns_status, https_status, length], colors))
|
|
else:
|
|
print(fmt_row([str(idx), domain, tld, code, title, ns_str, dns_status, https_status, length]))
|
|
def main():
|
|
parser = argparse.ArgumentParser(
|
|
description="Enumerate domain availability and metadata across multiple TLDs"
|
|
)
|
|
parser.add_argument(
|
|
"--name",
|
|
required=True,
|
|
help="Domain name without TLD (e.g. examplebrand)"
|
|
)
|
|
parser.add_argument(
|
|
"--tlds",
|
|
help="Custom TLD list separated by commas (e.g. com,id,su,st,cx)"
|
|
)
|
|
parser.add_argument(
|
|
"--no-common",
|
|
action="store_true",
|
|
help="Skip the built-in common TLD list"
|
|
)
|
|
parser.add_argument(
|
|
"--brute",
|
|
action="store_true",
|
|
help="Enable brute-force generation of alphabetic TLD combinations (a-z)"
|
|
)
|
|
parser.add_argument(
|
|
"--brute-min-len",
|
|
type=int,
|
|
default=1,
|
|
help="Minimum brute-force TLD length (default: 1)"
|
|
)
|
|
parser.add_argument(
|
|
"--brute-max-len",
|
|
type=int,
|
|
default=3,
|
|
help=(
|
|
"Maximum brute-force TLD length (default: 3). "
|
|
"WARNING: combinations grow exponentially (26^n). "
|
|
"len=3 -> 17,576 | len=4 -> 456,976 | "
|
|
"len=5 -> 11.8 million. Recommended maximum: 3-4."
|
|
),
|
|
)
|
|
parser.add_argument(
|
|
"--threads",
|
|
type=int,
|
|
default=30,
|
|
help="Number of worker threads (default: 30)"
|
|
)
|
|
parser.add_argument(
|
|
"--output",
|
|
default="Results-tld-domain.json",
|
|
help="Output JSON file path"
|
|
)
|
|
parser.add_argument(
|
|
"--only-resolved",
|
|
action="store_true",
|
|
help="Only save domains that successfully resolve to an IP address"
|
|
)
|
|
parser.add_argument(
|
|
"--only-200",
|
|
action="store_true",
|
|
help="Only save domains returning HTTP status 200"
|
|
)
|
|
parser.add_argument(
|
|
"--no-color",
|
|
action="store_true",
|
|
help="Disable colored CLI output"
|
|
)
|
|
args = parser.parse_args()
|
|
if args.no_color:
|
|
Colors.disable()
|
|
tlds = build_tld_list(args)
|
|
if not tlds:
|
|
print(
|
|
"[!] No TLDs selected. Use --tlds or do not enable --no-common."
|
|
)
|
|
sys.exit(1)
|
|
# Calculate how many TLDs come from the common list vs brute force
|
|
n_common = 0 if args.no_common else len(COMMON_TLDS)
|
|
n_brute = len(tlds) - n_common - (len(args.tlds.split(",")) if args.tlds else 0)
|
|
print(f"[*] Target name: {args.name}")
|
|
print(
|
|
f"[*] Total TLDs to check: {len(tlds)} "
|
|
f"(common: {n_common}, brute-force: {max(n_brute, 0)})"
|
|
)
|
|
print(f"[*] Worker threads: {args.threads}")
|
|
if args.brute:
|
|
print(
|
|
f"[*] Brute-force TLD length range: "
|
|
f"{args.brute_min_len}-{args.brute_max_len} characters"
|
|
)
|
|
results = []
|
|
start = time.time()
|
|
# IMPORTANT:
|
|
# Process common TLDs first (DNS + HTTP + title + NS lookup),
|
|
# then continue with brute-force generated TLDs.
|
|
# This ensures high-value and commonly used TLDs are prioritized.
|
|
common_set = set(COMMON_TLDS) if not args.no_common else set()
|
|
ordered_tlds = sorted(
|
|
tlds,
|
|
key=lambda t: (t not in common_set, tlds.index(t))
|
|
)
|
|
with concurrent.futures.ThreadPoolExecutor(
|
|
max_workers=args.threads
|
|
) as executor:
|
|
futures = {
|
|
executor.submit(enumerate_one, args.name, tld): tld
|
|
for tld in ordered_tlds
|
|
}
|
|
done_count = 0
|
|
for future in concurrent.futures.as_completed(futures):
|
|
tld = futures[future]
|
|
try:
|
|
res = future.result()
|
|
except Exception as e:
|
|
res = {
|
|
"domain": f"{args.name}.{tld}",
|
|
"tld": tld,
|
|
"resolved": False,
|
|
"error": str(e),
|
|
}
|
|
done_count += 1
|
|
if res.get("resolved"):
|
|
tag = green("RESOLVED")
|
|
if has_status_200(res):
|
|
tag = green("RESOLVED + HTTP 200")
|
|
else:
|
|
tag = "NO RESOLUTION"
|
|
origin = "common" if tld in common_set else "brute"
|
|
print(
|
|
f"[{done_count}/{len(tlds)}] "
|
|
f"({origin:6}) "
|
|
f"{res['domain']:<32} {tag}"
|
|
)
|
|
results.append(res)
|
|
if args.only_resolved:
|
|
results = [r for r in results if r.get("resolved")]
|
|
if args.only_200:
|
|
results = [r for r in results if has_status_200(r)]
|
|
# Sort results:
|
|
# 1. HTTP 200 domains first
|
|
# 2. Resolved domains before unresolved ones
|
|
# 3. Alphabetical by TLD
|
|
results.sort(
|
|
key=lambda r: (
|
|
not has_status_200(r),
|
|
not r.get("resolved"),
|
|
r["tld"]
|
|
)
|
|
)
|
|
|
|
print()
|
|
print("TABLE VIEW")
|
|
print()
|
|
print_table(results, use_color=not args.no_color)
|
|
print()
|
|
output_data = {
|
|
"target_name": args.name,
|
|
"total_checked": len(tlds),
|
|
"total_resolved": sum(
|
|
1 for r in results if r.get("resolved")
|
|
),
|
|
"total_status_200": sum(
|
|
1 for r in results if has_status_200(r)
|
|
),
|
|
"common_tlds_checked": n_common,
|
|
"brute_force_checked": max(n_brute, 0),
|
|
"elapsed_seconds": round(
|
|
time.time() - start,
|
|
2
|
|
),
|
|
"results": results,
|
|
}
|
|
with open(args.output, "w", encoding="utf-8") as f:
|
|
json.dump(
|
|
output_data,
|
|
f,
|
|
indent=2,
|
|
ensure_ascii=False
|
|
)
|
|
print(
|
|
f"\n[+] Completed in "
|
|
f"{output_data['elapsed_seconds']}s"
|
|
)
|
|
print(
|
|
f"[+] {output_data['total_resolved']} / "
|
|
f"{output_data['total_checked']} domains resolved"
|
|
)
|
|
print(
|
|
f"[+] {output_data['total_status_200']} "
|
|
f"domains returned HTTP 200"
|
|
)
|
|
print(
|
|
f"[+] Results saved to: "
|
|
f"{args.output}"
|
|
)
|
|
|
|
if __name__ == "__main__":
|
|
main()
|