mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-21 07:41:28 +02:00
Yogesh OjhaandClaude Opus 5
824f2c8ec3
Discovery was passive-only — subfinder, ctfr, crtname, assetfinder and certificate
SANs — so anything absent from a public source was absent from the scan, and every
later stage inherited the miss. It now runs two more sources after the passive merge,
carrying SubdomainSource.BRUTEFORCE and PERMUTATION through the same scoping and
merge every other provider uses.
Bruteforce is `dnsx -d <apex> -w <list>` over a wordlist shipped in the repo:
4,860 labels ranked by real-world frequency, regenerated by
scripts/fetch_subdomain_wordlist.py and committed like the port registry, so an
install with no egress still has one. The word budget reads from the top of that
ranking, which is why a smaller budget is simply the first N lines. Permutation is
alterx over the names already found, seeded apex-first because a name one label from
the apex has more siblings worth guessing than a five-label one.
Two things this needed to be worth running at all:
- **A budget, not an idle watchdog.** A guessed name that does not exist produces
no output, so the stall detector that protects the resolver killed both runs at
exactly 90s the first time. Guessing is bounded by total time instead, floored at
5 names/s against a measured 9, and says so when it stops early.
- **Wildcard rejection.** The wildcard probe moved ahead of expansion: on a wildcard
zone every guess answers, and storing 5,000 fake names would be worse than not
guessing. Answers that resolve only to the wildcard address are dropped and
counted in the source's note.
Both are skipped at passive intensity and say why — the stage still touches no
target, but a wordlist run does query the target's own nameservers. Bruteforce
defaults on at 1,000 words (110s measured, 2 hits on vulnweb.com, both attributed
correctly alongside their passive sources); permutations default off, because every
variant is another DNS query.
ProviderResult gained `note` so a source can come up short without being reported as
failed. alterx reads seeds from stdin — `-l <file>` answers "no input found".
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DPueZXQMbjLXMokXeA8LFP
73 lines
2.2 KiB
Python
73 lines
2.2 KiB
Python
"""alterx CLI client — permutation candidates generated from names already discovered."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from shared.logging import get_logger
|
|
from tools.runner import CLIToolRunner, OutputFormat, ToolNotFoundError
|
|
from tools.runner.models import CommandRecorder
|
|
|
|
logger = get_logger(__name__)
|
|
|
|
ALTERX_BINARY = "alterx"
|
|
DEFAULT_TIMEOUT = 600
|
|
|
|
|
|
class AlterxError(Exception):
|
|
pass
|
|
|
|
|
|
class AlterxClient:
|
|
def __init__(
|
|
self,
|
|
*,
|
|
limit: int,
|
|
enrich: bool = True,
|
|
patterns: list[str] | None = None,
|
|
recorder: CommandRecorder | None = None,
|
|
extra_args: list[str] | None = None,
|
|
) -> None:
|
|
self.limit = max(1, limit)
|
|
self.enrich = enrich
|
|
self.patterns = patterns or []
|
|
self.recorder = recorder
|
|
self.extra_args = extra_args or []
|
|
|
|
try:
|
|
self._runner = CLIToolRunner(ALTERX_BINARY, default_timeout=DEFAULT_TIMEOUT)
|
|
except ToolNotFoundError as e:
|
|
raise AlterxError(str(e)) from e
|
|
|
|
def permute(self, names: list[str]) -> list[str]:
|
|
"""Candidate hostnames built from the seeds. Generates, never resolves."""
|
|
if not names:
|
|
return []
|
|
args = ["-limit", str(self.limit)]
|
|
if self.enrich:
|
|
# words mined from the seeds themselves, which is what beats a blind list
|
|
args.append("-enrich")
|
|
for pattern in self.patterns:
|
|
args += ["-p", pattern]
|
|
|
|
result = self._runner.run(
|
|
args=args,
|
|
input_data=names,
|
|
# alterx reads its seeds from stdin; -l with a file path yields "no input found"
|
|
use_stdin=True,
|
|
use_output_file=False,
|
|
output_format=OutputFormat.PLAIN,
|
|
silent=True,
|
|
silent_flag="-silent",
|
|
recorder=self.recorder,
|
|
tool=ALTERX_BINARY,
|
|
extra_args=self.extra_args,
|
|
)
|
|
seeds = set(names)
|
|
out: list[str] = []
|
|
for line in result.output_lines:
|
|
candidate = line.strip().lower()
|
|
if candidate and candidate not in seeds:
|
|
out.append(candidate)
|
|
if len(out) >= self.limit:
|
|
break
|
|
return out
|