关于Anubis

Anubis是一款功能强大的子域名枚举与信息收集工具,该工具可以帮助广大研究人员整理来自各种数据源的数据,其中包括HackerTarget、DNSPumpster、x509 certs、VirusTotal、Google、Pkey、Sublist3r、Shodan、Spyse和NetCraft。值得一提的是,Anubis还有个姊妹项目,名为AnubisDB,该项目主要作为子域名的集中存储库。

工具依赖

如果你需要使用Anubis来执行端口扫描和证书扫描的话,则需要使用到Nmap。如果你使用的是Linux操作系统,则可以使用下列命令完成依赖组件的安装:

sudo apt-get install python3-pip python-dev libssl-dev libffi-dev

工具安装

该工具基于Python 3开发,因此我们首先需要在本地设备上安装并配置好Python 3环境。接下来,运行下列命令:

pip3 install anubis-netsec

源码安装

广大研究人员可以使用下列命令将该项目源码克隆至本地:

git clone https://github.com/jonluca/Anubis.git

接下来,切换到项目目录中,并使用pip3命令和requirements.txt来安装该工具所需的依赖组件:

cd Anubis

pip3 install  -r requirements.txt

pip3 install .

工具使用

查看帮助信息

Usage:

  anubis (-t TARGET | -f FILE) [-o FILENAME]  [-abinoprsSv] [-w SCAN] [-q NUM]

  anubis -h

  anubis (--version | -V)

  

Options:

  -h --help                       显示帮助信息和退出

  -t --target                      设置目标(多个目标用逗号分隔)

  -f --file                        设置目标(从文件读取,每个域名单独一行)

  -n --with-nmap                 执行Nmap服务/脚本扫描 

  -o --output                     输出数据存储文件名

  -i --additional-info              显示主机的额外信息(Shodan API)

  -p --ip                         输出每个子域名解析的IP地址

  -a --dont-send-to-anubis-db     不将结果发送至Anubis-DB

  -r --recursive                   递归搜索所有子域名

  -s --ssl                        执行SSL扫描并输出其他信息

  -S --silent                      只输出子域名,每个域名一行

  -w --overwrite-nmap-scan SCAN   覆盖默认Nmap扫描(默认为-nPn -sV -sC)

  -v --verbose                    打印调试信息和完整请求输出

  -q --queue-workers NUM          修改Worker队列数量(默认为10,最大为10)

  -V --version                       显示工具版本和退出

 

Help:

  For help using this tool, please open an issue on the Github repository:

  https://github.com/jonluca/anubis

基础使用

anubis -tip  domain.com -o out.txt

其中,domain.com为目标域名。

anubis -t reddit.com

上述命令将直接运行子域名枚举,结果如下:

Searching for subdomains for 151.101.65.140 (reddit.com)

 

Testing for zone transfers

Searching for Subject Alt Names

Searching HackerTarget

Searching VirusTotal

Searching Pkey.in

Searching NetCraft.com

Searching crt.sh

Searching DNSDumpster

Searching Anubis-DB

Found 193 subdomains

----------------

fj.reddit.com

se.reddit.com

gateway.reddit.com

beta.reddit.com

ww.reddit.com

... (truncated for readability)

Sending to AnubisDB

Subdomain search took 0:00:20.390

anubis -t reddit.com -ip

上述命令相当于anubis -t reddit.com --additional-info --ip,该命令会解析子域名的IP地址并通过Shodan来收集额外信息,命令显示结果如下:

Searching for subdomains for 151.101.65.140

Server Location: San Francisco US - 94107

ISP: Fastly

Found 27 domains

----------------

http://www.np.reddit.com: 151.101.193.140

http://nm.reddit.com: 151.101.193.140

http://ww.reddit.com: 151.101.193.140

http://dg.reddit.com: 151.101.193.140

http://en.reddit.com: 151.101.193.140

http://ads.reddit.com: 151.101.193.140

http://zz.reddit.com: 151.101.193.140

out.reddit.com: 107.23.11.190

origin.reddit.com: 54.172.97.226

http://blog.reddit.com: 151.101.193.140

alb.reddit.com: 52.201.172.48

http://m.reddit.com: 151.101.193.140

http://rr.reddit.com: 151.101.193.140

reddit.com: 151.101.65.140

http://www.reddit.com: 151.101.193.140

mx03.reddit.com: 151.101.193.140

http://fr.reddit.com: 151.101.193.140

rhs.reddit.com: 54.172.97.229

http://np.reddit.com: 151.101.193.140

http://nj.reddit.com: 151.101.193.140

http://re.reddit.com: 151.101.193.140

http://iy.reddit.com: 151.101.193.140

mx02.reddit.com: 151.101.193.140

mailp236.reddit.com: 151.101.193.140

Found 6 unique IPs

52.201.172.48

151.101.193.140

107.23.11.190

151.101.65.140

54.172.97.226

54.172.97.229

Execution took 0:00:04.604

高级使用

anubis -t reddit.com --with-nmap -o temp.txt -i --overwrite-nmap-scan "-F -T5"

执行结果如下:

Searching for subdomains for 151.101.65.140 (reddit.com)

 

Testing for zone transfers

Searching for Subject Alt Names

Searching HackerTarget

Searching VirusTotal

Searching Pkey.in

Searching NetCraft.com

Searching crt.sh

Searching DNSDumpster

Searching Anubis-DB

Searching Shodan.io for additional information

Server Location: San Francisco, US - 94107

ISP  or Hosting Company: Fastly

To run a DNSSEC subdomain enumeration, Anubis must be run as root

Starting Nmap Scan

Host : 151.101.65.140 ()

----------

Protocol: tcp

port: 80 state: open

port: 443 state: open

Found 195 subdomains

----------------

nm.reddit.com

ne.reddit.com

sonics.reddit.com

aj.reddit.com

fo.reddit.com

f5.reddit.com

... (truncated for readability)

Sending to AnubisDB

Subdomain search took 0:00:26.579

许可证协议

本项目的开发与发布遵循MIT开源许可证协议。

项目地址

Anubis:【GitHub传送门

参考资料

https://github.com/jonluca/Anubis-DB

https://medium.com/@jonluca/introducing-anubis-a-new-subdomain-enumerator-and-information-gathering-tool-d25b39ad98f2

https://shodan.io/

https://github.com/rdegges/skele-cli

https://reddit.com/r/netsec

https://github.com/bitquark/dnspop/tree/master/results

本文作者:Alpha_h4ck, 转自FreeBuf