{"id":13845641,"url":"https://github.com/knownsec/Kunyu","last_synced_at":"2025-07-12T03:31:38.456Z","repository":{"id":37754784,"uuid":"390210760","full_name":"knownsec/Kunyu","owner":"knownsec","description":"Kunyu, more efficient corporate asset collection","archived":false,"fork":false,"pushed_at":"2023-06-26T06:19:13.000Z","size":44498,"stargazers_count":967,"open_issues_count":27,"forks_count":134,"subscribers_count":15,"default_branch":"main","last_synced_at":"2024-04-26T14:03:39.917Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/knownsec.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-07-28T04:18:21.000Z","updated_at":"2024-06-05T23:49:37.858Z","dependencies_parsed_at":"2024-06-05T23:59:40.581Z","dependency_job_id":null,"html_url":"https://github.com/knownsec/Kunyu","commit_stats":null,"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/knownsec%2FKunyu","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/knownsec%2FKunyu/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/knownsec%2FKunyu/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/knownsec%2FKunyu/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/knownsec","download_url":"https://codeload.github.com/knownsec/Kunyu/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225791376,"owners_count":17524773,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:03:31.421Z","updated_at":"2025-07-12T03:31:38.439Z","avatar_url":"https://github.com/knownsec.png","language":"Python","funding_links":[],"categories":["Python","扫描器、资产收集、子域名"],"sub_categories":["网络服务_其他"],"readme":"\u003ch1 align=\"center\"\u003eKunyu(坤舆) - More efficient corporate asset collection\u003c/h1\u003e\r\n\r\n[![GitHub stars](https://img.shields.io/github/stars/knownsec/Kunyu)](https://github.com/knownsec/Kunyu) [![GitHub issues](https://img.shields.io/github/issues/knownsec/Kunyu)](https://github.com/knownsec/Kunyu/issues) [![GitHub release](https://img.shields.io/github/release/knownsec/Kunyu)](https://github.com/knownsec/Kunyu/releases)![](https://img.shields.io/badge/python-%3E%3D3.2-yellow) [![](https://img.shields.io/badge/author-风起-blueviolet)](https://github.com/wikiZ) [![](https://img.shields.io/badge/KnownSec-404Team-blue)](https://github.com/wikiZ)\r\n\r\n--------------\r\nEnglish | [中文文档](./doc/README_CN.md)\r\n\r\n![](./images/Kunyu2.png)\r\n\r\n# 0x00 Introduce\r\n\r\n## Tool introduction\r\n\r\nKunyu (kunyu), whose name is taken from \u003cKnuyu Wanguo Quantu\u003e, is actually a professional subject related to geographic information, which counts the geographic information of the sea, land, and sky. The same applies to cyberspace. The same is true for discovering unknown and fragile assets. It is more like a cyberspace map, which is used to comprehensively describe and display cyberspace assets, various elements of cyberspace and the relationship between elements, as well as cyberspace and real space. The mapping relationship. So I think \"Kun Yu\" still fits this concept.\r\n\r\nKunyu aims to make corporate asset collection more efficient and enable more security-related practitioners to understand and use cyberspace surveying and mapping technology. \r\n\r\n## Application scenario\r\n\r\nFor the use of kunyu, there can be many application scenarios, such as:\r\n\r\n* Forgotten and isolated assets in the enterprise are identified and added to security management.\r\n* Perform quick investigation and statistics on externally exposed assets of the enterprise.\r\n* Red and blue are used against related requirements, and batch inspections of captured IPs are performed.\r\n* Collect vulnerable assets in batches (0day/1day) for equipment and terminals within the impact.\r\n* Information on sites involved in new-type cybercrime cases is quickly collected and merged for more efficient research, judgment, and analysis.\r\n* Statistic and reproduce the fragile assets on the Internet that are affected by related vulnerabilities.\r\n* .......\r\n\r\n# 0x01 Install\r\n\r\n**Need Python3 or higher support**\r\n\r\n```\r\ngit clone https://github.com/knownsec/Kunyu.git\r\ncd Kunyu\r\npip3 install -r requirements.txt\r\n\r\nLinux:\r\n\tpython3 setup.py install\r\n\tkunyu console\r\n\r\nWindows:\r\n\tcd kunyu\r\n\tpython3 console.py\r\n\r\nPYPI:\r\n\tpip3 install kunyu\r\n\t\r\nP.S. Windows also supports python3 setup.py install.\r\n```\r\n\r\n# 0x02 Configuration instructions\r\nWhen you run the program for the first time, enter the following command to initialize the operation. Other login methods are provided, and the API method is recommended (username/password login is deprecated).\r\n```\r\nkunyu init --apikey \u003cyour zoomeye key\u003e --seebug \u003cyour seebug key\u003e\r\n```\r\n![](./images/setinfo.png)\r\n\r\nThe first time you use it, you need to use ZoomEye login credentials to use the tool to collect information. Currently, ZoomEye API requires payment.\r\n\r\nZoomEye access address: https://www.zoomeye.org/\r\n\r\nSeebug access address: https://www.seebug.org/\r\n\r\nThe output file path can be customized by the following command,The default output path is: C:/Users/active user/kunyu/output/  or /active user/kunyu/output\r\n\r\n```\r\nkunyu init --output C:\\Users\\风起\\kunyu\\output\r\n```\r\n\r\n![](./images/setoutput.png)\r\n\r\n# 0x03 Tool instructions\r\n\r\n## Detailed command\r\n\r\n```\r\nkunyu console\r\n```\r\n![](./images/infos.png)\r\n\r\n**ZoomEye**\r\n\r\n```\r\nGlobal commands:\r\n        info                                      Print User Info\r\n        Search \u003cQuery\u003e                            Comprehensive Information Search\r\n        SearchIcon \u003cFile\u003e/\u003cURL\u003e                   Query Based On Icon Image\r\n        SearchBatch \u003cFile\u003e                        Batch Query Assets In Files\r\n        SearchCert \u003cDomain\u003e                       SSL Certificate Search\r\n        SearchDomain \u003cDomain\u003e                     Domain Name Associated/Subdomain Search\r\n        EncodeHash \u003cEncryption\u003e \u003cQuery\u003e           Encryption Method Interface (Base64/HEX/MD5/mmh3)\r\n        HostCrash \u003cIP\u003e \u003cDomain\u003e                   Host Header Scan Hidden Assets\r\n        show \u003cconfig\u003e/\u003crule\u003e                      Show Can Set Options Or Kunyu Config\r\n        Seebug \u003cQuery\u003e                            Search Seebug Vulnerability Information\r\n        set \u003cOption\u003e                              Set Global Arguments Values\r\n        view/views \u003cID\u003e                           Look Over Banner Row Data Information\r\n        Cscan \u003cIP\u003e/\u003cPort\u003e                         Scans Port Information About CobaltStrike\r\n        PupilSearch \u003cURL\u003e/\u003cID\u003e                    Example Query Sensitive Interfaces And Information\r\n        CDNAnalysis \u003cDomain\u003e                      Identify Whether The Domain Name Is a CDN Asset\r\n        Pocsuite3                                 Invoke The Pocsuite Component\r\n        ExportPath                                Returns The Path Of The Output File\r\n        CreateMap                                 Generate An IP Distribution Heat Map\r\n        AliveScan                                 The Viability Of The Last Retrieval\r\n        clear                                     Clear The Console Screen\r\n        help                                      Print Help Info\r\n        exit                                      Exit KunYu \u0026 \r\n```\r\n\r\n**OPTIONS**\r\n\r\n```\r\nZoomEye:\r\n        page \u003cNumber\u003e       \t\tThe number of pages returned by the query (default:1)\r\n        size \u003cNumber\u003e      \t\tSet the number of searches per page (default:10)\r\n        fields \u003cfields\u003e     \t\tSet the response field information\r\n        dtype \u003c0/1\u003e         \t\tQuery associated domain name/subdomain name\r\n        stype \u003cv4/v6\u003e       \t\tstype \u003cv4/v6\u003e Set to get data type IPV4 or IPV6\r\n        btype \u003chost/web\u003e    \t\tSet the API interface for batch query\r\n        timeout \u003cnum\u003e       \t\tSet the timeout period of Kunyu HTTP request\r\n        thread              \t\tSet PupilSearch Thread Number(default is 10)\r\n        deep                \t\tSet PupilSearch Search Deep(default is 2)\r\n        all                 \t\tPupilSearch Add All Url To Check List\r\n        fuzz                \t\tPupilSearch Add Api To Check List\r\n        proxy               \t\tPupilSearch HTTP Proxy\r\n\t\r\n```\r\n\r\n## Use case introduction\r\n\r\n*Kunyu usage tutorial is as follows * \r\n\r\n**User information query**\r\n\r\n![](./images/userinfo.png)\r\n\r\n**Comprehensive search（NEW）**\r\n\r\n![](./images/search.png)\r\n\r\n**Custom output fields（NEW）**\r\n\r\nFor specific supported output custom fields, please refer to the following:\r\n\r\n| Field Name         | Type    | Description                                                  | Permission                  |\r\n| ------------------ | ------- | ------------------------------------------------------------ | --------------------------- |\r\n| ip                 | string  | IP address (used when the web asset is incomplete)           | All users                   |\r\n| domain             | string  | Domain                                                       | All users                   |\r\n| url                | string  | Full URL of the asset (for web assets)                       | All users                   |\r\n| ssl.jarm           | string  | SSL JARM fingerprint                                         | All users                   |\r\n| ssl.ja3s           | string  | SSL JA3S fingerprint                                         | All users                   |\r\n| iconhash_md5       | string  | MD5 value of the icon image                                  | Professional plan and above |\r\n| robots_md5         | string  | MD5 value of the robots.txt file                             | Business plan and above     |\r\n| security_md5       | string  | MD5 value of the security settings file                      | Business plan and above     |\r\n| hostname           | string  | Hostname information                                         | All users                   |\r\n| os                 | string  | Operating system information                                 | All users                   |\r\n| port               | integer | Port number                                                  | All users                   |\r\n| service            | string  | Provided application protocol (e.g., HTTP, SSH)              | All users                   |\r\n| title              | list    | Webpage title                                                | All users                   |\r\n| version            | string  | Component version information                                | All users                   |\r\n| device             | string  | Device name                                                  | All users                   |\r\n| rdns               | string  | Reverse DNS information                                      | All users                   |\r\n| product            | string  | Product component information                                | All users                   |\r\n| header             | string  | HTTP response header information                             | All users                   |\r\n| header_hash        | string  | Hash calculated from HTTP response header                    | Professional plan and above |\r\n| banner             | string  | Service banner information                                   | All users                   |\r\n| body               | string  | HTML Body content                                            | Business plan and above     |\r\n| body_hash          | string  | Hash calculated from the HTML body                           | Professional plan and above |\r\n| update_time        | string  | Asset update time                                            | All users                   |\r\n| header.server.name | string  | Server name in the HTTP response header                      | All users                   |\r\n| continent.name     | string  | Name of the continent                                        | All users                   |\r\n| country.name       | string  | Name of the country                                          | All users                   |\r\n| province.name      | string  | Name of the province                                         | All users                   |\r\n| city.name          | string  | Name of the city                                             | All users                   |\r\n| isp.name           | string  | ISP name                                                     | All users                   |\r\n| organization.name  | string  | Organization name                                            | All users                   |\r\n| zipcode            | integer | Postal code                                                  | All users                   |\r\n| idc                | string  | Is it an IDC (0 for no, 1 for yes)                           | All users                   |\r\n| lon                | string  | Geolocation longitude                                        | All users                   |\r\n| lat                | string  | Geolocation latitude                                         | All users                   |\r\n| asn                | string  | Autonomous System Number                                     | All users                   |\r\n| protocol           | string  | Transport layer protocol (e.g., TCP, UDP)                    | All users                   |\r\n| honeypot           | integer | Is it a honeypot (0 for no, 1 for yes)                       | All users                   |\r\n| ssl                | string  | SSL x509 certificate information                             | All users                   |\r\n| primary_industry   | string  | Primary industry information                                 | Business plan and above     |\r\n| sub_industry       | string  | Sub-industry information                                     | Business plan and above     |\r\n| rank               | integer | Asset importance ranking, the higher the score, the more important. | Business plan and above     |\r\n\r\n**Settings to change default output fields**\r\n\r\n```\r\nSet fields = ip,port\r\n```\r\n\r\n![](./images/fields.png)\r\n\r\n**Batch IP search**\r\n\r\n![](./images/searchbatch.png)\r\n\r\n**Icon Search**\r\n\r\nWhen collecting corporate assets, we can use this method to retrieve the same ico icon assets, which usually has a good effect when associating related corporate assets. But it should be noted that if some sites also use this ico icon, irrelevant assets may be associated (but people who are bored with other people's ico icons are always in the minority). Support url or local file search. \r\n\r\n**Command format:** \r\n\r\n```\r\nSearchIocn https://www.baidu.com/favicon.ico \r\nSearchIcon /root/favicon.ico \r\n```\r\n\r\n![](./images/searchico.png)\r\n\r\n**SSL certificate search**\r\n\r\nQuery through the serial number of the SSL certificate, so that the associated assets are more accurate, and services that use the same certificate can be searched. When you encounter an https site, you can use this method.\r\n\r\n![](./images/searchcert.png)\r\n\r\n**Multi-factor query**\r\n\r\nSimilarly, Kunyu also supports multi-factor conditional query related assets, which can be realized through ZoomEye logic operation syntax.\r\n\r\n![](./images/headersearch.png)\r\n\r\n**Feature Search**\r\n\r\nThrough HTTP request packet features or website-related features, the same framework assets can be concatenated more accurately\r\n\r\n![](./images/factor.png)\r\n\r\n**Associated Domain/Subdomain Search**\r\n\r\nSearch for associated domain names and subdomains, and query associated domain names by default. You can set **associated domain name/subdomain name** two modes by setting the dtype parameter. \r\n\r\nCommand format: **SearchDomain Domain** \r\n\r\n![](./images/searchdomain.png)\r\n\r\n**Set the type of data to be obtained**\r\n\r\nAfter the V1.6.1 version, the user can set the data type obtained through the stype parameter to IPV4 or IPV6 to realize the application scenario, and the default parameter is v4.\r\n\r\nCommand format: **set stype = v6**\r\n\r\n![](./images/stype.png)\r\n\r\n**View Banner Information** \r\n\r\nThe user can view the banner corresponding to the specified serial number through the view command, so as to further analyze the front-end code and Header header, and the user can intercept the banner information for further association matching. \r\n\r\nCommand format: **view ID** \r\n\r\n![](./images/view.png)\r\n\r\nThe user can also view the SSL certificate information of the specified serial number through the views command, and further associate it by extracting the sensitive information in the SLL certificate information.\r\n\r\nCommand format: **views ID**\r\n\r\n![](./images/views.png)\r\n\r\n**Cscan Scans port information about cobaltStrike**\r\n\r\nCscan, a new feature in Kunyu version 1.7.2, allows you to use this command to identify whether a network asset is cobaltStrike and to enumerate configuration file details.\r\n\r\n**Command format:**\r\n\r\n```\r\nCscan 1.1.1.1 443\r\nCscan 1.1.1.1 443,80\r\n```\r\n\r\n![](./images/cscan.png)\r\n\r\n**CDNAnalysis（NEW）**\r\n\r\nNote that when using Kunyu through code compilation, this function module is not provided by default. If you need to add this function, you need to compile it yourself and add it to the /lib/cdn/ path under the kunyu running path. Name it **linux**, darwin**, and windows.exe** according to the operating system used.\r\n\r\nhttps://github.com/wikiZ/CDN-Discovery\r\n\r\n**Command format:**\r\n\r\n```\r\nCDNAnalysis --file ip.txt\r\nCDNAnalysis --domain www.baidu.com\r\n```\r\n\r\n![](./images/CDNAnalysis.png)\r\n\r\n**PupilSearch Sensitive Information Collection**\r\n\r\nAfter Kunyu v1.7.0, the KeyWord command was removed and replaced with PupilSearch, which is the function of extracting sensitive data. Of course, it also supports the extraction of historical banner information through spatial mapping. For example, such as accesskey, the banner in historical data leaks sensitive data. Information, even if the service is changed now, but the AK/SK has not expired, it can still be used directly, understand everything, and support the extraction of sensitive information **(ID number, IP, JWT, API interface, appid, appkey, GithubAccessKey, default username \\password, email, etc.)**.\r\n\r\n**Command format:**\r\n\r\nPupilSearch https://www.domain.com/\r\n\r\nPupilSearch ID (extract sensitive information from the banner returned by spatial mapping)\r\n\r\n![](./images/pupilsearch_1.png)\r\n\r\n![](./images/pupilsearch_2.png)\r\n\r\n![](./images/pupilsearch_3.png)\r\n\r\n**System command execution** \r\n\r\nAfter Kunyu v1.6.0, support for the execution of system commands has been added. You can debug surveying and mapping data more conveniently and effectively by executing some commonly used system commands. For a list of specific executable commands, see Article 11 in the Issue of the README file. \r\n\r\n**Example One** \r\n\r\n![](./images/systems.png)\r\n\r\n**Example two **\r\n\r\n![](./images/system.png)\r\n\r\n**Encoding hash calculation**\r\n\r\nIn some scenarios, you can use this command to perform common HASH encryption/encoding, such as BASE64, MD5, mmh3, HEX encoding, and debug in this way.\r\n\r\n**Command format:** \r\n\r\n```\r\nEncodeHash hex 7239dcc9beb5c9cd795415f9\r\nEncodeHash md5 https://www.baidu.com/favicon.ico\r\nEncodeHash md5 /root/favicon.ico\r\nEncodeHash mmh3 https://www.baidu.com/favicon.ico\r\nEncodeHash mmh3 /root/favicon.ico\r\nEncodeHash base64 dasdasdsa\r\n```\r\n\r\n![](./images/encode.png)\r\n\r\n**Asset Survival Scan**\r\n\r\nAfter Kunyu V1.6.5, the survivability scan of the last retrieval result is added, and the result is output in real time by polling.\r\n\r\n![](./images/alivescan.png)\r\n\r\n**Seebug vulnerability query**\r\n\r\nYou can query historical related vulnerabilities by entering information about the framework and equipment you want to find, but you need to note that only English is supported, and improvements and upgrades will be made later.\r\n\r\nCommand format: **Seebug tongda** \r\n\r\n![](./images/seebug.png)\r\n\r\n**Load fingerprint file**\r\n\r\nKunyu V1.6.4 adds the function of loading an external fingerprint library. Kunyu provides 5 fingerprint files as a reference by default. Users can write their own fingerprint files to load or share, and retrieve them more flexibly, which is convenient for traceability and security. Resource sharing in research and red team offense and defense, enhance teamwork.\r\n\r\nYou can view the information of the currently loaded fingerprint library through the **show rule** command.\r\n\r\n![](./images/rule.png)\r\n\r\nThe default read fingerprint file directory is under **project directory/kunyu/rule**, you can customize the read fingerprint file path setting through **kunyu init --rule C:\\风起\\rule**.\r\n\r\nYou can use the **show config** command to view the information of the Kunyu configuration file.\r\n\r\n![](./images/showconfig.png)\r\n\r\nWhen faced with complex fingerprint information, you can generate a yaml file through **project directory/kunyu/createrule.py**\r\n\r\n![](./images/createrule.png)\r\n\r\nThe format of the yaml fingerprint file is as follows. Please note that the following standard format must be strictly followed, and no fields are missing.\r\n\r\n```bash\r\nKXID: kx-2022-07\r\nauthor: 风起\r\ncreateDate: 2022-1-4\r\ndescription: 查找公网部署的ngrok反向代理\r\nkx_name: ngrok代理工具指纹\r\nkx_query: '''Server: beegoServer:1.12.0'' +''\u003ca href=\"/login/index\"\u003eFound\u003c/a\u003e.'''\r\nsource: https://github.com/wikiZ/Kunyu\r\n```\r\n\r\n**Setting parameters**\r\n\r\nWhen set page = 2, the returned results are 40. You can modify the page parameter to set the number of pages to be queried. Note that 1 page = 20/items. You can modify the value according to your needs to get more returned results. \r\n\r\nThe configurable parameters and the current values of the parameters are displayed through show. \r\n\r\n![](./images/show.png)\r\n\r\n![](./images/set.png)\r\n\r\n**Pocsuite linkage**\r\n\r\nIn versions after v1.3.1, you can use kunyu to link the console mode of pocsuite3 for integrated use.\r\n\r\n![](./images/pocsuite.png)\r\n\r\n**HOSTS head collision**\r\n\r\nThrough HOSTS collision, the hidden assets in the intranet can be effectively collided. According to the ServerName domain name and IP configured in the middleware httpf.conf, the access can be directly connected to the intranet business system! Follow-up by setting the local hosts file to achieve local DNS resolution, because the priority of the local hosts file is higher than the DNS server resolution. Support reverse check through ZoomEye domain name library or read TXT file to get the list of domain names. \r\n\r\n**Command format:** \r\n\r\n```\r\nHostCrash C:\\ip.txt C:\\host.txt \r\nHostCrash C:\\ip.txt baidu.com \r\nHostCrash 1.1.1.1 baidu.com \r\nHostCrash 1.1.1.1 G:\\host.txt \r\n```\r\n\r\n**Example One** \r\n\r\n![](./images/searchcrash.png)\r\n\r\n**Example Two** \r\n\r\n![](./images/searchcrashs.png)\r\n\r\n**Serverless HostCrash Scan**\r\n\r\nKunyu v1.6.2 adds an interesting feature that combines the cloud function to perform HOSTS collisions on the target. In this way, our scanned IP is effectively hidden to prevent it from being captured by the target situational awareness, and it also prevents WAF from banning the real IP. , And conceal the features. Through the following scanning effect, it can be found that the scanned IPs are all cloud service vendors and each scan is a random IP address. You can choose whether to enable it by configuring the cloud function address during initialization.\r\n\r\n**Configuration Guide:** [Configuration Method of Cloud Function](./doc/Serverless_EN.md)\r\n\r\n**Related technology:**https://www.anquanke.com/post/id/261551\r\n\r\n**Situational Awareness Scanning Effect:**\r\n\r\n![](./images/serverless.png)\r\n\r\n**Asset distribution map**\r\n\r\nv1.6.2 adds the CreateMap command, which can generate a geographic location distribution map for the assets retrieved last time, and more vividly describe the mapping relationship between network space and real space. It is located in the same output directory as Excel, and the generated asset map is the same as the last time. The number of search results is related.\r\n\r\n**Generate distribution map**\r\n\r\n![](./images/createmap.png)\r\n\r\n**Web page**\r\n\r\n![](./images/map.png)\r\n\r\n**Data result**\r\n\r\nAll search results are saved in the user's root directory, and the directory is created based on the current timestamp. All query results of a single start are stored in an Excel format under one directory, giving a more intuitive experience. The output path can be returned through the ExportPath command.\r\n\r\n![](./images/output.png)\r\n\r\n\r\n# 0x04 Loading\r\n\r\n​    In fact, there are still many ideas, but as an Alpha version, this is the case, and it will continue to be improved in the later period. I hope that Kunyu can be known to more security practitioners. Thank you for your support.\r\n\r\n​    The tool framework has reference to Kunlun Mirror and Pocsuite3, which are all very good works.\r\n\r\n​\tAbout the developer Fengqi(风起) Related articles: https://www.anquanke.com/member.html?memberId=148652 \r\n\r\n​    Thanks to all the friends of KnownSec 404 Team.\r\n\r\n\u003e \"Seeing clearly\" is the embodiment of ability, which is \"tool\", while \"seeing\" is the embodiment of thought, and the last thing it is related to is \"Tao\".\t——SuperHei（黑哥）\r\n\r\n# 0x05 Issue\r\n\r\n**1. Multi-factor search**\r\n\r\nZoomEye search can use multi-factor search, dork: cisco +port:80 (note the space) can search for all data that meets the cisco and port:80 conditions. If there is no space in the middle, it is the same search condition, that is, all data that meets cisco and port 80. Kunyu's dork does not need quotation marks, **The new version 2.0 syntax has changed. **\r\n\r\n**2. High-precision geographic location**\r\n\r\nZoomEye gives privileged users high-precision geographic location data, but it should be noted that ordinary users do not have this function, please be aware.\r\n\r\n**3. Username/password login**\r\n\r\nIf you use username/password as the initialization condition, the token obtained will be valid for 12 hours. If you find that your search cannot return data, you may as well info it. If the session times out, the initialization command prompt will be returned. In most cases, we recommend that you use the API KEY method, and there will be no expiration problem. This design is also for the security of your account and password. After all, the API KEY can be reset and the token will become invalid, but with the account and password, it is possible to log in to your ZoomEye account.\r\n\r\n**4. Cert certificate search**\r\n\r\nIt should be noted that according to conventional logic, you need to encode the serial number of the target SSL certificate in hexadecimal before searching with the statement, but Kunyu only needs to provide the Domain address to search. The principle is to make a request to the target station to obtain the serial number and process it, but if your host cannot access the target to be searched, it cannot be retrieved. At this time, you can also use the conventional method to search with the statement.\r\n\r\n**5. Favicon icon search**\r\n\r\nico icon search supports both URL search and local ico icon file search, which has better scalability and compatibility.\r\n\r\n**6. Query data storage path**\r\n\r\nBy default, your query data is in the Kunyu folder under the user directory. You can also use the ExportPath command in console mode to query the path.\r\n\r\n**7. Auto-completion**\r\n\r\nKunyu's auto-completion supports uppercase and lowercase letters, command records, etc. Use Tab to complete. For usage, please refer to Metasploit.\r\n\r\n**8. About the error when using pip install kunyu**\r\n\r\nWhen using pip install kunyu, the following error is reported:\r\n`File \"C:\\Users\\风起\\AppData\\Local\\Programs\\Python\\Python37\\Scripts\\kunyu-script.py\", line 1 SyntaxError: Non-UTF-8 code starting with '\\xb7' in file C:\\Users\\风起\\AppData\\Local\\Programs\\Python\\Python37\\Scripts\\kunyu-script.py on line 1, but no encoding declared; see http://python.org/dev/peps/pep-0263/ for details`\r\n\r\nSolution:\r\nModify the C:\\Users\\风起\\AppData\\Local\\Programs\\Python\\Python37\\Scripts\\kunyu-script.py file and add # encoding: utf-8 at the beginning of the file\r\nThen save it and it can be used normally. The reason for this bug is that there is a Chinese name in the user directory path, which usually appears on Windows.\r\n\r\n**9. Pocsuite3 module POC storage directory**\r\n\r\nWhen using the pocsuite3 module, if you want to add a new POC module, you can add the POC file in **project directory/pocsuite3/pocs/**. It should be noted that when using the packaged Kunyu console command, the POC should be added to the directory, and the kunyu program should be repackaged to load the POC normally.\r\n\r\n**10. Pocsuite3 module POC missing problem**\r\n\r\nWhen using the Pocsuite command linkage, if it is a packaged Kunyu version, the poc has been fixed. At this time, modifying the poc directory cannot add a new module. At this time, you can repackage it or use **project directory/kunyu/console.py** to run kunyu to update the poc module in real time.\r\n\r\n**11. Kunyu executable system commands are as follows. **\r\n\r\n**Windows:**\r\nOS_SYSTEM = [**\"ipconfig\", \"dir\", \"whoami\", \"ping\", \"telnet\", \"cd\", \"findstr\", \"chdir\",\"find\", \"mysql\", \"type\", \"curl\", \"netstat\", \"tasklist\", \"taskkill\", \"tracert\", \"del\", \"ver\",\"nmap\",\"ls\"**]\r\n\r\n**Linux/Mac:**\r\n\r\n OS_SYSTEM = [**\"ifconfig\", \"ls\", \"cat\", \"pwd\", \"whoami\", \"ping\", \"find\", \"grep\", \"telnet\", \"mysql\", \"cd\", \"vi\", \"more\", \"less\", \"curl\", \"ps\", \"netstat\", \"rm\", \"touch\", \"mkdir\", \"uname\",\"nmap\"**]\r\n\r\n**12. Kunyu operating environment**\r\n\r\nIt is recommended to use Python3.2 - 3.12. Other versions of Python3 may have unknown errors. **Python2 cannot be used**.\r\n\r\n**13. Set timeout**\r\n\r\nIf the HTTP request is not responded to in time, you can solve it by increasing the timeout time, such as: set timeout = 50\r\n\r\n**14. Kunyu client startup time is long**\r\n\r\nSince Kunyu2.0 will identify and use domestic and foreign interfaces during the initialization phase, it may take a while to start and use, the time is 5-10 seconds.\r\n\r\n**15. RULE fingerprint storage location**\r\n\r\nThe RULE fingerprint storage location can be configured and modified under ~/.kunyu.ini, and the default is under the compiled and run kunyu path.\r\n\r\n**16. View function cannot be used**\r\n\r\nThe view function is in the ZoomEye update, and the business version membership is required to use it normally. The views function is not affected.\r\n\r\n**17. Abnormal BUG**\r\n\r\nSince the test environment is MAC OS, there may be incompatibility issues in other operating systems. Please feedback the ISSUE or contact the operation in time.\r\n\r\n**18. Antivirus software check**\r\n\r\nKunyu may fail to start due to antivirus software checking files, please pay attention to this problem\r\n\r\n**19. I haven't decided yet ^_^**\r\n\r\n# 0x06 Contributions\r\n\r\n[风起@knownsec 404](https://github.com/wikiZ)  \r\n[wh0am1i@knownsec 404](https://github.com/wh0am1i)  \r\n[fenix@knownsec 404](https://github.com/13ph03nix)  \r\n[0x7F@knownsec 404](https://github.com/0x7Fancy)\r\n\r\n# 0x07 Events\r\n\r\n **WHC 2021 (补天白帽大会) Best Weapon of the Year Award **\r\n\r\n **KCON 2021 Arsenal**\r\n\r\n## 404Starlink\r\n\u003cimg src=\"https://github.com/knownsec/404StarLink-Project/raw/master/logo.png\" width=\"30%\"\u003e\r\n\r\nKunyu has joined [404Starlink](https://github.com/knownsec/404StarLink)\r\n\r\n\r\n# 0x08 Community\r\n\r\nIf you have any questions, you can submit an issue under the project, or contact us through the following methods.\r\n\r\n1、Scan the Wechat QR code to add ZoomEye operation Wechat, and comment on Kunyu, which will draw everyone to the ZoomEye Cyberspace Surveying and Mapping Exchange Group for communication. \r\n\r\n![](./images/yunying.jpg)\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknownsec%2FKunyu","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fknownsec%2FKunyu","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknownsec%2FKunyu/lists"}