klyrek-assets

Asset and infrastructure discovery. Three independent pieces:

• subdomains — resolves a curated wordlist of common subdomains against a base domain using stdlib DNS only (socket.getaddrinfo; no dnspython dependency, so this covers A/AAAA-style resolution, not full record types like MX/TXT/NS).
• buckets — detects Amazon S3 / Google Cloud Storage / Azure Blob Storage references in HTML or JS body text, and probes S3/GCS references for a public directory listing (both expose an S3-compatible XML API, so the same <ListBucketResult> check covers both).
• sensitive_files — probes a small, curated set of commonly-exposed paths (.env, .git/config, wp-config.php.bak, .aws/credentials, ...). Before probing, it fetches one deliberately-nonexistent path as a baseline so a server that returns 200 for every URL (an SPA catch-all) doesn't produce a findings for every path checked.

from klyrek_assets.buckets import extract_cloud_storage_refs, probe_bucket_exposure
from klyrek_assets.sensitive_files import probe_sensitive_files
from klyrek_assets.subdomains import enumerate_subdomains

subdomains = enumerate_subdomains("target.com")
findings = probe_sensitive_files(client, "https://target.com/")
for ref in extract_cloud_storage_refs(page_html):
    finding = probe_bucket_exposure(client, ref)