phpfierce/fierce.php at master · m0rtem/phpfierce · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
#!/usr/bin/env php
<?php
///////////////////////////////////////////////////////////
// PHP FIRECE DNS Analysis by m0rtem.        	         //
// eh                                       	         //
// thanks to rsnake for the idea                         //
///////////////////////////////////////////////////////////

ini_set('max_execution_time', 0);

include("lib/rollingcurlx.class.php");

// Remove first argument
array_shift($argv);

// Defaults
$target = "";
$bruteforcefile = "data/subdomainscommon.txt";
$openSocketsAllowed = 20;

// If there are arguments
if ($argc > 1)
{
  	// Variables
	$target = $argv[0];

	// If user gave us a brute force file to work with else use default
	if(isset($argv[1]))
	{
		$bruteforcefile = "data/".$argv[1];
	}

	// If open sockets allowed setting set
	if(isset($argv[2]))
	{
		$openSocketsAllowed = $argv[2];
	}

	// Run the scan
	initialize($target, $bruteforcefile, $openSocketsAllowed);

}
else
{
	showHelp();
}


function showHelp()
{
	echo "Usage: php fierce.php [<target>] <bruteforce file> <number of open sockets>".PHP_EOL;
}

function initialize($target,$bruteforce,$openSocketsAllowed)
{
	echo "     _       ___ _                 ".PHP_EOL;
	echo " ___| |_ ___|  _|_|___ ___ ___ ___ ".PHP_EOL;
	echo "| . |   | . |  _| | -_|  _|  _| -_|".PHP_EOL;
	echo "|  _|_|_|  _|_| |_|___|_| |___|___|".PHP_EOL;
	echo "|_|     |_|                        ".PHP_EOL;
	echo "  a dns analysis tool by m0rtem".PHP_EOL.PHP_EOL;

	// Start timer
	$time_start = microtime(true);

	echo "Starting phpfierce on target - ".$target."".PHP_EOL.PHP_EOL;
	echo "Attempting DNS lookup...".PHP_EOL.PHP_EOL;

	// Start DNS query
	$result = dns_get_record($target,DNS_ALL);

	foreach($result as $results)
	{
		if(isset($results['ip']))
		{
			$s = $results['ip'];
		}
		else if(isset($results['target']))
		{
			$s = $results['target'];
		}
		$ip = gethostbyname($s);
		echo "".$results['type']." - ".$s."".PHP_EOL;
		echo "    |".PHP_EOL;
		echo "    -> ".$ip."".PHP_EOL.PHP_EOL;
	}

	// Start bruteforce
	$numberOfLines = count(file($bruteforce));
	$contents = file($bruteforce);

	echo PHP_EOL."Starting " . $numberOfLines . " tests via bruteforce, please wait...".PHP_EOL.PHP_EOL;

	$RCX = new RollingCurlX($openSocketsAllowed);
	$RCX->setTimeout(10); //in milliseconds

	// Loop through file and handle queries
	foreach($contents as $line) {
		$url = trim($line).".".$target;
		$options = [CURLOPT_VERBOSE => false, CURLOPT_FOLLOWLOCATION => true, CURLOPT_RETURNTRANSFER => true,CURLOPT_TIMEOUT_MS => 1];
		$headers = ["Content-type: application/xml"];
		$post_data = null;
		$user_data = ['foo', 'bar'];
		$RCX->addRequest($url, $post_data, 'callback_functn', $user_data, $options, $headers);
	}

	$RCX->execute();

	// End timer
	$time_end = microtime(true);
	$execution_time = $time_end - $time_start;
	echo PHP_EOL.'Total Execution Time: '.number_format((float)$execution_time, 2, '.', '').' seconds.'.PHP_EOL;

}

function callback_functn($response, $url, $request_info, $user_data, $time) {

	if($request_info['primary_ip'])
	{
		$ip = $request_info['primary_ip'];
		$timeFormatted = floor($time % 1000);

		// If using proxychains i think this should fix, ha
		if($ip == "127.0.0.1")
		{
			$ip = gethostbyname($url);
		}

		echo $request_info['url'] . " - " . $ip . " (".$timeFormatted."ms)" . PHP_EOL;

	}
}


?>