快速暴力破解域名

参考http://www.room362.com/blog/2014/01/29/hostname-bruteforcing-on-the-cheap/
方法一
cat subdomains.txt | xargs -P 122 -I subdomain dig +noall subdomain.microsoft.com +answer
man xargs:
       --max-procs=max-procs
       -P max-procs
              Run  up  to  max-procs processes at a time; the default is 1.  If max-procs is 0, xargs will run as many processes as possible at a time.  Use the -n
              option with -P; otherwise chances are that only one exec will be done.
       -I replace-str
              Replace occurrences of replace-str in the initial-arguments with names read from standard input.  Also, unquoted blanks do not terminate input items;
              instead the separator is the newline character.  Implies -x and -L 1.
       -t     Print the command line on the standard error output before executing it.
dig命令:
+noall:参数让dig在输出时不显示企标
+answer:让dig输出仅显示应答部分
+nocmd:删除输出的命令信息,它必须在域名的前面才能生效
方法二
cat subdomains.txt | parallel -k -j0 dig +noall {}.microsoft.com +answer
       -k       Keep sequence of output same as the order of input. Normally the output of a job will be printed as soon as the job completes. Try this to see the
                difference:

                  parallel -j4 sleep {}\; echo {} ::: 2 1 4 3
                  parallel -j4 -k sleep {}\; echo {} ::: 2 1 4 3
警告:-j0选项会使Linux尽可能的处理文件和任务,通常会使VM宕机。所以应该使用像50,100这种小数据来避免宕机。

猜你喜欢

转载自j4s0nh4ck.iteye.com/blog/2118004