[addtool] ReconBulk

[piyush-security]

[homepage]
https://github.com/TaurusOmar/reconbulk
[/homepage]

[tags]
recon, enumeration, subdomains, domains, bugbounty
[/tags]

[short_descr]
Automated Subdomain Enumeration and Scanning Tool
[/short_descr]

[long_descr]

ReconBulk

Automated Subdomain Enumeration and Scanning Tool

______                    ______       _ _
| ___ \                   | ___ \     | | |
| |_/ /___  ___ ___  _ __ | |_/ /_   _| | | __
|    // _ \/ __/ _ \| '_ \| ___ \ | | | | |/ /
| |\ \  __/ (_| (_) | | | | |_/ / |_| | |   <
\_| \_\___|\___\___/|_| |_\____/ \__,_|_|_|\_\


					V.1.0
					Taurus Omar

Scanning crt.sh...

Target ==> projectdiscovery.io

Searching in the CertSpotter API... 🔍
Searching in the Crtsh database API... 🔍
Searching in the Threatcrowd API... 🔍
Searching in the AnubisDB API... 🔍
Searching in the Urlscan.io API... 🔍
Searching in the Threatminer API... 🔍
Searching in the Sublist3r API... 🔍
Searching in the Archive.org API... 🔍

This script automates the process of subdomain enumeration and scanning using several popular open-source tools, combining their results and providing detailed output. The primary purpose of this tool is to simplify and streamline the process of discovering subdomains and their related information for a given domain.

Features

• Uses Amass, Subfinder, Assetfinder, Findomain, crt.sh, MassDNS, Httpx, Naabu, and Nuclei
• Combines subdomain results from all tools into a single file
• Extracts IP addresses for discovered subdomains
• Scans subdomains with Httpx and sorts the results
• Scans subdomains with Naabu to find open ports
• Scans subdomains with Nuclei for potential vulnerabilities
• Organizes results in a structured directory
• The tool follows a logical structure to gather the subdomains and information from each tool to be used by the next one.
• Postive httpx subdomains are used for scanning by Nuclei.

File Structure

recon/
└── results/
└── example.com-<timestamp>/
├── amass_example.com/
│   ├── config.ini
│   ├── db/
│   ├── named/
│   └── notes.md
├── amass_example.com.txt
├── assetfinder_example.com.txt
├── findomain_example.com.txt
├── httpx_example.com.txt
├── naabu_example.com.txt
├── nuclei_example.com.txt
├── subdomains/
│   ├── amass_example.com.txt
│   ├── assetfinder_example.com.txt
│   ├── crt.sh.txt
│   ├── findomain_example.com.txt
│   ├── subfinder_example.com.txt
│   └── unique_subdomains.txt
└── subfinder_example.com.txt

Installation

1. If you have Go installed and configured (i.e. with $GOPATH/bin in your $PATH):

go install github.com/TaurusOmar/reconbulk@latest

2. Install all required tools:

• Amass
• Subfinder
• Assetfinder
• Findomain
• MassDNS
• Httpx
• Naabu
• Nuclei

Make sure all these tools are in your system's PATH.

3. Prepare a list of DNS resolvers. You can find a sample list here.

Usage

reconbulk <domain> <resolvers_list>

• <domain>: The target domain to scan
• <resolvers_list>: The file path to your list of DNS resolvers

The script will create a directory named ~/recon/results/<domain>-<timestamp> containing the output files from each tool.

Output

The output directory will contain the following files:

• amass_{domain}.txt: Output from Amass
• subfinder_{domain}.txt: Output from Subfinder
• assetfinder_{domain}.txt: Output from Assetfinder
• findomain_{domain}.txt: Output from Findomain
• {domain}.crt.txt: Output from crt.sh
• {domain}.subdomains.txt: Combined and unique subdomains from all tools
• {domain}.ips.txt: IP addresses associated with the discovered subdomains
• httpx_{domain}.txt: Results of the Httpx scan
• sorted_httpx_{domain}.txt: Sorted Httpx results
• naabu_{domain}.txt: Results of the Naabu scan
• nuclei_{domain}.txt: Results of the Nuclei scan

[/long_descr]

[image]

[/image]

[gwen001]

Issue correctly handled, tool is waiting for human validation.

[gwen001]

Tool has been refused by the team, feel free to get in touch if you have any question.

Thank you!

[gwen001]

Tool has been refused by the team, feel free to get in touch if you have any question.

Thank you!