渗透测试-信息收集-c段收集
平时做渗透测试我比较喜欢用lijiejie 写的 subDomainsBrute来爆破子域名
那么爆破完成后就想收集一下网站的c段信息
下面以平安为例
爆破得到子域名为
i.pingan.com.cn 183.129.178.89 www.pingan.com.cn 202.69.26.13 club.pingan.com.cn 202.69.18.234 home.pingan.com.cn 202.69.21.142 mail.pingan.com.cn 202.69.21.81 member.pingan.com.cn 202.69.26.18 resources.pingan.com.cn 202.69.26.6 b.pingan.com.cn 202.69.26.12 car.pingan.com.cn 202.69.19.184 wap.pingan.com.cn 202.69.26.16 api.pingan.com.cn 202.69.21.123 vp.pingan.com.cn 202.69.21.236 learn.pingan.com.cn 202.69.21.84 wifi.pingan.com.cn 116.31.80.134 download.pingan.com.cn 119.145.207.56, 113.107.107.15, 183.57.145.14, 113.107.57.44, 218.6.110.15, 59.56.26.227 legacy.pingan.com.cn 202.69.21.81 t.pingan.com.cn 202.69.26.20 cash.pingan.com.cn 202.69.21.176 money.pingan.com.cn 202.69.26.12 update.pingan.com.cn 210.83.237.20 citrix.pingan.com.cn 202.69.19.26 vpn.pingan.com.cn 183.63.51.72 cm.pingan.com.cn 202.69.21.64 cz.pingan.com.cn 202.69.23.155 mx1.pingan.com.cn 202.69.19.105 events.pingan.com.cn 202.69.26.57 rss.pingan.com.cn 202.69.19.41 map.pingan.com.cn 121.15.166.179 ai.pingan.com.cn 202.69.21.226 sip.pingan.com.cn 202.69.18.186, 202.69.18.183 dialin.pingan.com.cn 202.69.21.70 meet.pingan.com.cn 202.69.21.70 mx2.pingan.com.cn 202.69.19.104 localhost.pingan.com.cn 127.0.0.1 ask.pingan.com.cn 116.31.80.169 rms.pingan.com.cn 202.69.18.168 push.pingan.com.cn 202.69.21.76 ocs.pingan.com.cn 218.17.221.53 stock.pingan.com.cn 202.69.18.155 mb.pingan.com.cn 183.63.51.69 bank.pingan.com.cn 202.69.23.136 mx4.pingan.com.cn 202.69.18.86 tb.pingan.com.cn 202.69.26.19 sbc.pingan.com.cn 121.15.166.178, 58.251.11.225 recruit.pingan.com.cn 202.69.19.118 ck.pingan.com.cn 183.63.51.71 mx5.pingan.com.cn 202.69.19.217 message.pingan.com.cn 202.69.18.33 fund.pingan.com.cn 202.69.26.4 mgw.pingan.com.cn 202.69.26.46 txt.pingan.com.cn 119.145.207.55, 218.5.238.218, 183.57.144.150 pcs.pingan.com.cn 202.69.21.99 ehs.pingan.com.cn 202.69.21.172 vpn.bank.pingan.com.cn 218.17.146.201
写了一个python脚本，一个域名对应多个ip的我这里是抛弃处理
#coding=utf-8
import re
from sys import argv
__author__ = "depycode"
def getC(ipList):
resiplist = []
for i in ipList:
if i.startswith("127") or i.startswith("192.168") or i.startswith("10.") or i.startswith("172"):
continue
else:
ip = re.match(r"\d+\.\d+\.\d+\.", i)
ips = ip.group(0)
resiplist.append(ips)
resiplist = list(set(resiplist))
return resiplist
def saveC(ipList,f):
for i in ipList:
for j in range(1,256):
f.write(i+str(j)+"\n")
f.close()
if __name__ == "__main__":
if len(argv)!=3:
print "usage:./script.py sub.txt res.txt"
exit()
f1 = open(argv[1],"r")
f2 = open(argv[2],"w+")
lis = f1.readlines()
iplist = []
for i in lis:
s = re.split("\s+",i)
ip = s[1].strip()
if len(ip)<=16:
iplist.append(ip)
reslist = getC(iplist)
saveC(reslist, f2)
print reslist
print "success save to %s"% str(argv[2])
f1.close()
用法也比较简单
python test.py test.txt res.txt
结果如下
