{"id":20706687,"url":"https://github.com/montysecurity/InfraHunter","last_synced_at":"2025-05-10T20:30:50.583Z","repository":{"id":155924712,"uuid":"584551768","full_name":"montysecurity/InfraHunter","owner":"montysecurity","description":"Actively hunt for attacker infrastructure by filtering Shodan results with URLScan data.","archived":false,"fork":false,"pushed_at":"2024-07-18T15:24:38.000Z","size":179,"stargazers_count":60,"open_issues_count":0,"forks_count":9,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-11-17T01:28:43.679Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/montysecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-01-02T22:28:04.000Z","updated_at":"2024-10-10T05:38:01.000Z","dependencies_parsed_at":"2023-06-15T11:15:56.498Z","dependency_job_id":"f2c63bae-ceaa-4094-b236-979cddba4ff5","html_url":"https://github.com/montysecurity/InfraHunter","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/montysecurity%2FInfraHunter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/montysecurity%2FInfraHunter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/montysecurity%2FInfraHunter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/montysecurity%2FInfraHunter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/montysecurity","download_url":"https://codeload.github.com/montysecurity/InfraHunter/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253480258,"owners_count":21915245,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-17T01:23:51.944Z","updated_at":"2025-05-10T20:30:50.310Z","avatar_url":"https://github.com/montysecurity.png","language":"Python","funding_links":[],"categories":["Integrations and plugins"],"sub_categories":[],"readme":"# InfraHunter\n\nActively hunt for attacker infrastructure by filtering Shodan results with URLScan data.\n\n## Requirements\n\n- Shodan API Key\n- URLScan API Key\n- `python3 -m pip install -r requirements.txt`\n\n## Usage Examples\n\n`python3 .\\hunter.py -q \"http.html:'titan stealer'\" -s {Shodan API Key} -u {URLScan API Key}`\n\n![Usage Example](assets/usage.png)\n\n### Builtin Queries\n\nYou can use pre-built queries by supplying their name with `-q`. To list all builtin queries, run `python .\\hunter.py -l`.\n\n`python3 .\\hunter.py -s {Shodan API Key} -u {URLScan API Key} -q google-phishing-http-title`\n\n### Discord\n\nYou can also provide a URL to a Discord webhook with `-d, --discord`. This will send the results to that webhook instead of opening them in a browser.\n\n## What do I do?\n\n1. Search Shodan with the query provided by `-q, --query`\n2. For each combination of IP/port/protocol and domain/port/protocol, submit it to URLScan\n    - If it has multiple open ports, all ports will be submitted\n    - Submits *http* and *https* URLs\n    - Same process for all domains\n3. For each URLScan\n    - Check to see if the page scanned returned a HTTP OK (200)\n    - Check to see if it has an screenshot of the web page in the URLScan results\n    - Download the image and calculate its SHA256 and delete the image\n    - Check the SHA256 against a list of hashes to exclude (this list is stuff I have deemed non-malicious but plan on making a way to bypass this check) (the list exists because I use this tool to hunt on a schedule)\n    - For each remaining result not excluded by the hash check, return the result\n\n## API Rate Limiting\n\nThe tool is harcoded to sleep 20 seconds between URLScan submissions to be nice. By default it uses public scans, this can be changed with `--scan-type`.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmontysecurity%2FInfraHunter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmontysecurity%2FInfraHunter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmontysecurity%2FInfraHunter/lists"}