Some helper subdomain_takeover_tools to validate subdomain takeovers
Project description
Subdomain Takeover Tools
A set of tools to validate the initial outcome of subtake.
Installation
-
Install using pip:
pip install subdomain_takeover_tools
for windows:
py -m pip install subdomain_takeover_tools
Alternatively, you can download or clone this repo and call
pip install -e .
.
Confirming takeovers
All scripts support the following two parameters:
--strict
: only report as vulnerable if the issue is not also applicable onhostname.tld
andwww.hostname.tld
.--inverse
: do inverse reporting, so report all subdomains that are not vulnerable
Confirming S3
Subtake has some false positives on Google Cloud buckets as S3 buckets, also some access denied's end up in the results.
The script confirm-s3.py
will make sure that the bucket is actually vulnerable.
grep "\[s3 bucket: " subtake-output.txt | confirm_s3
Confirming ELB
Some patterns of elb are vulnerable while others are not, to filter them we can use our script:
grep "\[elasticbeanstalk: " subtake-output.txt | confirm_elb
Note: the parameter --strict
is accepted here but will not lead to expected results.
Confirming Shopify
It seems that
grep "\[shopify: " subtake-output.txt | confirm_shopify
Separate tools
Extracting domain names
As part of my process I want to know the domains involved in my findings.
Example usage:
< subtake-output.txt | cut -f3 | python3 extract_domain_names.py | sort -u > involved.domains
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for subdomain_takeover_tools-0.9.0.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 9dbe2b7b68acdb78b5903e41467e42738a725bdc3c31e900b6bdda3fedc785ad |
|
MD5 | 93dd2b0901256f7e785d03ab04edcc3f |
|
BLAKE2b-256 | 88779c4362920f28bdf10f17bb4f17ad598f58f613911960a28d03ad799ed8ad |
Hashes for subdomain_takeover_tools-0.9.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 8cedd2b5e818f0be43bba26e3b9b81071728bc6bb113004092f8b62eb1a48a15 |
|
MD5 | 2fd231604904ef7b557a1cfe8908d37c |
|
BLAKE2b-256 | 7b2475c61353fe2191538a1fad4851242424e766cab76b1feb3b34bf8f126460 |