Here you can find some scripts that use Netlas.io search engine. Some of them may be of interest to pen testers or bug bounty hunters, and some to enthusiasts in the field of information security. Anyone can freely use these repository contents as examples when developing their own integrations or scripts. The code is available under Creative Commons License.
Do not forget to install Netlas Python SDK:
pip install netlasNote: more about Netlas Python SDK & CLI Tool on Netlas Docs →.
- Passive Recon Script
- HTTP Responses Download
- Amass and Netlas Recon
- Vulnerabilities Search
- Passive Scanner
- Emails by Domain
- Documents by Domain
- Company Tech Profile
Use this script to passively extend an atack surface of any target. It gets a files with domains, subdomains, IP addresses and CIDRs as an input info and returns a list of domains, subdomains and IP addresses that are also related to the target. Read more about how it works in this article.
Usage:
bash netlas_domains_and_ip_recon.sh domains_IPs_CIDRs.txtOutput files:
domains_from_netlas.txt- a list of domains and subdomains, having at least one A-record, which was found;ips_from_netlas.txt- a list of A-records.
Use this script to download web pages available in Netlas.io Responses Search tool. It gets a files with domains, subdomains and IP addresses as an input and returns a set of html files associated with these targets.
This script takes as input the files obtained as a result of the work of the previous one and loads all the pages from all objects, which will later automatically check them for vulnerabilities. Read more about how it works in this article.
Usage:
bash netlas_download_http_responses.sh domains_from_netlas.txt ips_from_netlas.txtOutput files:
./responses/domain-443_page_path_!200.html - directory with .html files, where:
domain– a target host from input file;443– a port number;_page_path_– a path on the server, where this page is located (slashes replased by "_"); in this case page downloaded from https://domain:443/page/path/!200– an HTTP server response code.
A script that starts searching for subdomains and visualizing the results using OWASP Amass.
Note: don't forget to edit config.ini if you want Amass to use Netlas searches as well.
You can read more about the script and utility settings for interacting with Netlas in this article.
Usage:
bash amass_netlas_recon.shOutput files:
results/ - directory with list of subdomains in .txt format and graph in .html.
Use this script to check objects from your attack surface for vulnerabilities. Searching by vulnerability pattern is supported (you need to manually add a request to the script) or by identifier (just enter CVE). Read more how it works in this article.
Usage:
python3 netlas_cve_surface_check.pyIf you are searching by vulnerability pattern: fix the sQuery line in netlas_cve_surface_check.py. You need to replace the search available there (for example, the script contains CVE-2023-36434, search for Microsoft IIS servers) with another one compiled by you or taken from our Twitter/Telegram. Then run the script and follow the instructions in the terminal: enter the path to the file that contains your surface, then select the "Pattern" mode.
If you are searching by CVE: you don't need to fix anything in the script. Instead, run it and follow the instructions in the terminal: enter the path to the file, select the "CVE" mode, and enter the identifier in the format "CVE-...-...".
Output:
Count of probably vulnerable objects, their names.
The script is designed to quickly and passively scan your surface using data stored by Netlas. Data is obtained from all responses of a given host, and information such as a list of vulnerabilities with their criticality, used ports, protocols, and software (Netlas tags) is displayed.
Usage:
python3 netlas_passive_scan.py -i file_with_hostsAdditional arguments:
-o / --output - output format. The default is YAML, which can be changed to JSON (json argument).
-k / --key - your API key. The default is obtained from the corresponding variable in the script code, but you can change it (input like --key nEwKEy).
Output:
Data in YAML/JSON format in the console. Can be saved to a file using output redirection (> or >>).
This script will allow you to quickly collect all email addresses associated with a specific domain. This can help both during OSINT investigations and during pen tests to collect targets for social engineering.
Note: To use this script you need a paid subscription with access to contacts.
Usage:
python3 netlas_emails_by_domain.py domain_nameAdditional arguments:
-k/--key - your API key. The default is obtained from the OS-specific user config dir, but you can change it (input like --key nEwKEy).
-e/--print-errors - Displaying errors during the parsing process is disabled by default.
Output:
A sequence of email addresses in the console can be redirected to a file using output redirection (> or >>).
This script will allow you to quickly collect all documents which store in responses associated with specific domain. This can help both during OSINT investigations and during pen tests to collect targets for social engineering.
Usage:
python3 netlas_docs_by_domain.py domain_nameAdditional arguments:
-k/--key - Your API key. The default is obtained from the OS-specific user config dir, but you can change it (input like --key nEwKEy).
-e/--print-errors - Displaying errors during the parsing process is disabled by default.
Output:
Links to documents in the console, can be redirected to a file using output redirection (> or >>).
This script allows you to semi-automatically collect information about the technological profile of a company, including the services used, providers, registrars, and so on. You can read more here.
Usage:
python3 netlas_company_tech_profile.py -i file_with_scopeAdditional arguments:
-k/--key - Your API key. The default is obtained from the OS-specific user config dir, but you can change it (input like --key nEwKEy).
-s/--services - Path to file with services list.
Output:
Summary containing all the information found.