libraccon a library for high performance offensive security tool for reconnaissance based on raccoon scanner. This library is based on Raccoon A high performance offensive security tool for reconnaissance and vulnerability scanning. The difference is we are providing a library to be used as a module.
This is because we wanted to integrated raccoon to our nmmapper, but we couldn't do it easily, so we just had to re-write this tool to provide module level import.
As mentioned this module is designed to be used like a module in other python scripts
fromlibraccoon.libsimportwaffromlibraccoon.libs.sub_domainimportSubDomainEnumeratorfromlibraccoon.libs.storage_explorerimportStorageExplorerThis is how we intended to use this module.
WAF Stands for web application firewall.
fromlibraccoon.libs.hostimportHostfromlibraccoon.libsimportwaf# Initiate hosthost=Host(target="nmmapper.com")
# Begin the wafw=waf.WAF(host)
awaitw.detect()
results=w.get_waf# Returns dictprint(results)
{'waf': 'Cloudflare'}You will always get results in dict or list
fromlibraccoon.libs.hostimportHosfromlibraccoon.libs.sub_domainimportSubDomainEnumeratorhost=Host(target="nmmapper.com")
subs=SubDomainEnumerator(host)
awaitsubs.run()
# Enumerating Subdomains# Trying to discover subdomains in Google
.....
# Done enumerating Subdomainssubs.get_subdomains
['nmmapper.com',
'mail.nmmapper.com',
'upstream.nmmapper.com',
'flower.nmmapper.com',
'analytics.nmmapper.com',
'www.nmmapper.com']Once again this is module type, can be used in any other external python programs
If you want to find which ips are hosted on the same network, you can use bingip2host, this tool still requires improvements.
ip="172.67.209....."# CloudFlarefromlibraccoon.libs.bingip2hostimportBingIp2Hostbing=BingIp2Host(ip)
awaitbing.search()
print(awaitbing.get_domains())
[{'ip': '172.67.209....', 'domain': 'www.------.fi', 'source': 'bing'},
{'ip': '172.67.209....',
'domain': '-----.uk',
'source': 'bing'},
.......
# More results are hidden
.....
]This is how you can query whos information
fromlibraccoon.libs.dns_handlerimportDNSHandlerwho=DNSHandler("nmmapper.com")
# Registrarr=awaitwho.grab_whois("nmmapper.com")
{'domain_name': 'NMMAPPER.COM',
'registrar': 'NameCheap, Inc.',
'whois_server': 'whois.namecheap.com',
#... More records truncated
}
# Querying invididual recordstxt=awaitwho.query_dns("google.com", "TXT")
A=awaitwho.query_dns("google.com", "A")
Ipv6=awaitwho.query_dns("google.com", "AAAA")This module is a port of the fierce tool, we wanted something non commandline we wanted something that can be used as a module, so we had to re-write it to support being used as a module.
#!/usr/bin/python3/# Basic searchfromlibraccoon.libs.fierceimportLibFiercelib=LibFierce("facebook.com")
ret=lib.search("www")
{'102.132.96.16': 'edge-shortwave-shv-01-mba1.facebook.com.',
'102.132.96.35': 'edge-star-mini-shv-01-mba1.facebook.com.',
'102.132.96.19': 'edge-stun-shv-01-mba1.facebook.com.',
'102.132.96.22': 'edge-z-p1-shv-01-mba1.facebook.com.',
#....More result has been truncated
}The module is not yet fully complete.
Traverse IPs near discovered domains to search for contiguous blocks
#!/usr/bin/python3/# Basic searchfromlibraccoon.libs.fierceimportLibFiercelib=LibFierce("facebook.com")
ret=lib.search("www", 10)
{'102.132.96.16': 'edge-shortwave-shv-01-mba1.facebook.com.',
'102.132.96.35': 'edge-star-mini-shv-01-mba1.facebook.com.',
'102.132.96.19': 'edge-stun-shv-01-mba1.facebook.com.',
'102.132.96.22': 'edge-z-p1-shv-01-mba1.facebook.com.',
#....More result has been truncated
}Remember the tool is designed to be used as a library to be incorporated into other tools. Just want caveat ensure that whatweb tool is installed.
fromlibraccoon.libs.whatwebapiimportWhatWebAsyncwhat=WhatWebAsync()
host="https://www.nmmapper.com"result=awaitwhat.scan(host)
[{'target': 'https://www.nmmapper.com',
'http_status': 200,
'request_config': {'headers': {'User-Agent': 'WhatWeb/0.5.5'}},
'plugins': {'Content-Language': {'string': ['en']},
'Cookies': {'string': ['csrftoken', 'sessionid']},
'Country': {'string': ['UNITED STATES'], 'module': ['US']},
'Django': {},
'HTML5': {},
'HTTPServer': {'string': ['cloudflare']},
'HttpOnly': {'string': ['sessionid']},
'IP': {'string': ['104.21.54.232']},
'Meta-Author': {'string': ['Nmmapper.com']},
'Open-Graph-Protocol': {'version': ['article']},
'Script': {'string': ['Javascript',
'application/ld+json',
'text/Javascript',
'text/javascript']},
'Strict-Transport-Security': {'string': ['max-age=15552000; includeSubDomains; preload']},
'Title': {'string': ['Nmmapper Subdomain finder,Nmap online,theharvester']},
'UncommonHeaders': {'string': ['x-content-type-options,referrer-policy,cross-origin-opener-policy,access-control-allow-origin,cf-cache-status,report-to,nel,cf-ray,alt-svc,server-timing']},
'X-Frame-Options': {'string': ['DENY']}}}]