Skip to content

Home

Jump to bottom
pirozas edited this page Aug 19, 2024 · 7 revisions

Hostdigger

Hostdigger is a universal and powerful tool for scanning and discovering network hosts across the globe. Whether you are looking to find bughosts for free internet access, bypass ISP firewalls, or perform security assessments, Hostdigger offers a comprehensive set of features and flexible input options to cater to your needs.

Key Features

Ping Scan

  • Purpose: Assess the availability and responsiveness of hosts by sending ICMP echo requests.
  • Usage: Quickly determine if a host is reachable or down, useful for network diagnostics.
  • Examples:
    • File Input: 
      hostdigger ping -f targets.txt
      Description: Pings all hosts listed in targets.txt to check their status.
    • CIDR Input: 
      hostdigger ping -c 192.168.1.0/24
      Description: Pings all IP addresses within the CIDR range 192.168.1.0/24 to check their status.

TLS Scan

  • Purpose: Identify and verify TLS/SSL certificates on designated ports to ensure secure communication.
  • Usage: Assess the validity, configuration, and details of TLS certificates on web servers.
  • Examples:
    • File Input: 
      hostdigger tls -f domains.txt -p 443
      Description: Scans all domains listed in domains.txt on port 443 for TLS certificates and their details.
    • CIDR Input: 
      hostdigger tls -c 192.168.1.0/24 -p 443
      Description: Scans all IP addresses within the CIDR range 192.168.1.0/24 on port 443 for TLS certificates.

SNI Scan

  • Purpose: Extract Server Name Indication (SNI) from TLS handshakes to reveal hostnames associated with IP addresses.
  • Usage: Useful for identifying virtual hosts on a server and understanding the hosted services.
  • Note: For SNI scans, domains must be used rather than CIDRs or IP ranges.
  • Examples:
    • File Input: 
      hostdigger sni -f domains.txt
      Description: Extracts SNI information from all domains listed in domains.txt, showing the hostnames served by those domains.

SSH Scan

  • Purpose: Test SSH services to evaluate their responses and behavior using customizable payloads. This feature is particularly useful for identifying vulnerabilities or configurations in SSH servers.
  • Usage: Conduct SSH scans with the option to specify a custom payload. If no payload is provided, an inbuilt default payload is used. Supports input files or CIDR ranges for specifying the targets.
  • Options:
    • --server or -s: Define the SSH server (domain or IP address) to use for sending SSH requests.
    • --payload or -d: Specify a custom payload to be used in the SSH scan. If omitted, the inbuilt default payload is used.
    • --file or -f: Specify a file containing a list of targets (domains, IPs, or CIDRs) to scan.
    • --cidr or -c: Directly provide CIDR blocks for scanning.
  • Examples:
    • With Custom Payload:
      • File Input: 
        hostdigger ssh -f targets.txt -s ssh.example.com -d "custom_payload"
        Description: Tests SSH services on hosts listed in targets.txt using ssh.example.com as the server for sending requests, with the provided custom payload.
      • CIDR Input: 
        hostdigger ssh -c 192.168.1.0/24 -s ssh.example.com -d "custom_payload"
        Description: Scans all IP addresses within the CIDR range 192.168.1.0/24 for SSH services, using ssh.example.com as the server and applying the custom payload.
    • Without Custom Payload:
      • File Input: 
        hostdigger ssh -f targets.txt -s ssh.example.com
        Description: Tests SSH services on hosts listed in targets.txt using ssh.example.com as the server, with the inbuilt default payload.
      • CIDR Input: 
        hostdigger ssh -c 192.168.1.0/24 -s ssh.example.com
        Description: Scans all IP addresses within the CIDR range 192.168.1.0/24 for SSH services, using ssh.example.com as the server with the inbuilt default payload.
  • Note: The payload option is optional. If you don’t add a payload, the inbuilt default payload will be used automatically.

Probe Scan

  • Purpose: Send specific requests to ports to identify services or extract information from servers.
  • Usage: Useful for probing various services and gathering information based on predefined probes. This feature does not accept custom payloads but sends standard probes to specified ports.
  • Options:
    • --file or -f: Specify a file containing a list of targets to probe.
    • --port or -p: Define the port to probe.
  • Examples:
    • File Input: 
      hostdigger probe -f targets.txt -p 80
      Description: Sends standard probes to port 80 on all hosts listed in targets.txt to identify active services.
    • CIDR Input: 
      hostdigger probe -c 192.168.1.0/24 -p 80
      Description: Sends standard probes to port 80 on all IP addresses within the CIDR range 192.168.1.0/24 to identify active services.

Sweep Scan

  • Purpose: Perform a series of HTTP/HTTPS requests to detect services behind CDNs and proxies.
  • Usage: Discover services obscured by CDNs, proxies, or load balancers.
  • Options:
    • --file or -f: Specify a file containing a list of targets to sweep.
  • Examples:
    • File Input: 
      hostdigger sweep -f domains.txt
      Description: Sends a series of HTTP/HTTPS requests to all domains listed in domains.txt to identify services that may be hidden behind CDNs or proxies.

Input File Formats

Hostdigger supports various input file formats, including lists of domains, CIDR blocks, or a combination of both. Below are examples of acceptable formats:

  • Domains Only: 
    example.com
testsite.org
example.net
  • CIDRs Only: 
    192.168.1.0/24
10.0.0.0/8
162.159.129.0-162.159.129.255
  • Mixed (Domains and CIDRs): 
    example.com
192.168.1.0/24
testsite.org
162.159.129.0-162.159.129.255

These formats allow users to customize their scans according to the types of targets they need to investigate.

Command-Line Options

  • -f or --file: Specifies the input file containing a list of targets. The targets can be domains, IP addresses, CIDR ranges, or a mix of these formats.
  • -c or --cidr: Directly specifies a CIDR range or an IP range in the format startIP-endIP for scanning.
  • -p or --port: Specifies the port on which the scan should be performed. Applicable in TLS, Probe, and Sweep scans.
  • -s or --server: Specifies the SSH server (domain or IP address) to be used for sending SSH requests.
  • -d or --payload: Specifies a custom payload for the SSH scan. If omitted, the inbuilt default payload will be used.

For any questions or support,reach out via Telegram: pirozas

Clone this wiki locally