Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/spiderlabs/hosthunter
HostHunter a recon tool for discovering hostnames using OSINT techniques.
https://github.com/spiderlabs/hosthunter
bugbounty hacking hacking-tool hosthunter hostnames ip network-security open-source osint penetration-testing pentest pentest-tool pentesting recon reconnaissance scoping security-tools tool virtual-hosts
Last synced: about 1 month ago
JSON representation
HostHunter a recon tool for discovering hostnames using OSINT techniques.
- Host: GitHub
- URL: https://github.com/spiderlabs/hosthunter
- Owner: SpiderLabs
- License: mit
- Created: 2018-05-17T20:31:18.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2023-03-30T14:14:12.000Z (over 1 year ago)
- Last Synced: 2024-10-09T14:23:21.572Z (about 1 month ago)
- Topics: bugbounty, hacking, hacking-tool, hosthunter, hostnames, ip, network-security, open-source, osint, penetration-testing, pentest, pentest-tool, pentesting, recon, reconnaissance, scoping, security-tools, tool, virtual-hosts
- Language: Python
- Homepage: https://github.com/SpiderLabs/HostHunter
- Size: 19.2 MB
- Stars: 1,068
- Watchers: 46
- Forks: 180
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
[]()
[](https://github.com/SpiderLabs/HostHunter/releases)
[](https://github.com/SpiderLabs/HostHunter/blob/master/LICENSE)
[](https://github.com/SpiderLabs/HostHunter/issues)
[](https://twitter.com/superhedgy)
HostHunter v2.0
======
A tool to efficiently discover and extract hostnames providing a large set of target IPv4 or IPv6 addresses. HostHunter utilises simple OSINT and active reconaissance techniques to map IP targets with virtual hostnames. This is especially useful for discovering the true attack surface of your organisation.
Output can be generated in multiple formats including CSV, TXT or Nessus file formats.
## Demo
__Click on the thumbnail above to view the demo.__
## Installation
* Tested with Python 3.10.8.
### Linux / Mac OS
* Install Python dependencies.
```bash
$ python3.10 -m pip install -r requirements.txt
```
## Simple Usage Example
```bash
$ python3.10 hosthunter.py
```
```bash
$ cat vhosts.csv
```
## More Examples
HostHunter Help Page
```bash
$ python3.10 ./hosthunter.py -h
usage: hosthunter.py [-h] [-f FORMAT] [-o OUTPUT] [-t TARGET] [-g GRAB] [-v] [-V] [-d] [targets]
[?] HostHunter v2.0 - Help Page
positional arguments:
targets Sets the path of the target IPs file.
options:
-h, --help show this help message and exit
-f FORMAT, --format FORMAT
Choose between .CSV and .TXT output file formats.
-o OUTPUT, --output OUTPUT
Sets the path of the output file.
-t TARGET, --target TARGET
Hunt a Single IP.
-g GRAB, --grab GRAB Choose which SSL ports to actively scan. Default ports: 21/tcp, 25/tcp, 443/tcp, 993/tcp, 8443/tcp
-v, --verify Attempts to resolve IP Address
-V, --version Displays the current version.
-d, --debug Displays additional output and debugging information.
Author: Andreas Georgiou (@superhedgy)
```
Run HostHunter Screen Capture module and output a Nessus file:
```bash
$ python3.10 hosthunter.py --nessus -o hosts.csv
```
Display Results
```bash
$ cat hosts.csv
```
View Screenshots
```bash
$ open ./screen_captures/
```
## Features
- [x] Works with Python3.10
- [x] Extracts information from SSL/TLS certificates.
- [x] Supports Free HackerTarget API requests.
- [x] Takes Screenshots of the target applications.
- [x] Validates the targets IPv4 address.
- [x] Supports .txt and .csv output file formats
- [x] Gathers information from HTTP headers.
- [x] Verifies Internet access.
- [x] Retrieves hostname values from services at 21/tcp, 25/tcp, 80/tcp and 443/tcp ports.
- [x] Supports Nessus target format output.
- [x] Improve output (IPs, HostNames, FQDNs)
- [X] Actively pull SSL certificates from other TCP ports
- [X] Select with SSL ports to target
- [X] Verify discovered hostnames against target IPs
- [x] Support for IPv6
## Coming Next
- [ ] Pause and Resume Execution
- [ ] Support for a Premium HackerTarget API key
- [ ] Gather information from additional APIs
## Notes
* Free APIs throttle the amount of requests per day per source IP address.
## License
This project is licensed under the MIT License.
## Authors
* **Andreas Georgiou** - follow me on twitter - [@superhedgy](https://twitter.com/superhedgy)
## Contribute
Feel free to create a Pull Request if you have any ideas or features you would like to add. Otherwise reach me out on twitter @superhedgy.
## StarGazers
Thank you for all the support & feedback!
[](https://starchart.cc/SpiderLabs/HostHunter)