#!/usr/bin/env bash
# @author: Danilo Basanta
# @author-linkedin: https://www.linkedin.com/in/danilobasanta/
# @author-github: https://github.com/dabasanta

# GLOBAL VARS - DO NOT MODIFY
export DOMAIN="None"
export EXTENDED_CHECKS=false
export zone_transfer="No"
export dns_servers_count=0
export subdomains_count=0
export webservers_count=0
# Modify the DNS_BRUTE_THREADS variable to set the number of threads to use in the custom-dictionary attack.
# By default, the script will use 15% of the number of records in the dictionary.
export DNS_BRUTE_THREADS=0

# CRTL+C handler
function scape() {
  clean
}
trap scape INT

# Creating the tmp directory
tmpdir="/tmp/dnsexplorer"
mkdir -p $tmpdir
mkdir -p $tmpdir/whatweb
mkdir -p $tmpdir/wafw00f
tput civis

end="\e[0m"
info="\e[36m[+]"
cyan="\e[36m"
output_color="\e[0m\e[36m"
error="\e[1m\e[91m[!]"
question="\e[93m"
yellow="\e[1m\e[93m"
green="\e[92m"
ok="\e[1m\e[92m"
resalted_output="\e[1;37m"

# Clean -exit- function
clean(){
    echo -e "\n\n"
    rm -rf $tmpdir
    echo -e "${end}Happy hunting."
    tput cnorm
    exit 0
}

# Custom dicctionary attack function
dictionaryAttackCustom() { #5
  dicc_outfile="$tmpdir/dicctionary.results.txt"
  : > "$dicc_outfile"
  check=0
  while [ "$check" -eq 0 ]; do
    echo -e "$question"
    read -rp "Ingrese la ruta del archivo de diccionario> " dfile
    echo -e "$end"

    if [ ! -f "$dfile" ] || [[ $(file "$dfile" | awk '{print $2}') != @(ASCII|Unicode) ]]; then
      echo -e "$error El archivo $dfile no existe o no es un archivo de texto ASCII/Unicode."
    else
      check=1
    fi
  done

  lon_dicc=$(wc -l < "$dfile")
  tput civis

  threads=$(echo "scale=0; ($lon_dicc * 0.15 + 0.5)/1" | bc)
  [ "$threads" -lt 1 ] && threads=1
  [ "$threads" -gt 40 ] && threads=40
  [ "$DNS_BRUTE_THREADS" -ne 0 ] && threads="$DNS_BRUTE_THREADS"
  echo -e "    ${question}This file has $lon_dicc records, $threads parallel processes will be used to speed up the attack, press any key to start\n"
  read -n 1 -s -r -p ""

  grep -Eva '[^a-zA-Z0-9\-_]' < "$dfile" | xargs -P $threads -I {} sh -c '
    GREEN="\033[32m"
    resalted_output="\e[1;37m"
    RESET="\033[0m"
    lon_dicc="$4"
    if host "$1.$2" 2>/dev/null | head -1 | grep -q "has address"; then
      echo "$1.$2" >> "$3"
      printf "    [+] Found: ${resalted_output}%s.%s${RESET}\n" "$1" "$2"
    fi

    echo "." >> /tmp/dnsexplorer/tracker.txt
    len=$(wc -l < /tmp/dnsexplorer/tracker.txt)
    dicc=$()
    percent=$(echo "scale=2; ($len / $lon_dicc) * 100" | bc)
    printf "${GREEN}[%.0f%%] Reading file...${RESET}\r" $percent
  ' _ {} "$DOMAIN" "$dicc_outfile" "$lon_dicc"

  total=$(wc -l < $dicc_outfile)
  echo ""
  echo -e "${info} $total Subdomains found.${end}"
  echo ""
  crtSH "dicattack"
}

# Dictionary attack function
dictionaryAttack(){ #5
  tput civis
  bitquark="$tmpdir/bit.txt"
  dicc_outfile="$tmpdir/dicctionary.results.txt"
  echo "" > $dicc_outfile
  echo -e "\n${info}Using SECLISTS: bitquark-subdomains-top100000.txt${end}\n"
  curl -s https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/bitquark-subdomains-top100000.txt -o $bitquark
  l_bitq=$(cat $bitquark | wc -l)
  touch $tmpdir/tracker.txt
  if [ $l_bitq -gt 999 ];then
    grep -v '^ *#' < "$bitquark" | xargs -P 40 -I {} sh -c '
    GREEN="\033[32m"
    resalted_output="\e[1;37m"
    RESET="\033[0m"

    if host "$1.$2" | head -1 | grep -q "has address"; then
      echo "$1.$2" >> "$3"
      printf "    [+] Found: ${resalted_output}%s.%s${RESET}\n" "$1" "$2"
    fi

    echo "." >> /tmp/dnsexplorer/tracker.txt
    len=$(wc -l < /tmp/dnsexplorer/tracker.txt)
    percent=$(echo "scale=2; ($len / 100000) * 100" | bc)
    printf "${GREEN}[%.0f%%] Reading file...${RESET}\r" $percent
  ' _ {} "$DOMAIN" "$dicc_outfile"
  total=$(wc -l < $dicc_outfile)
  echo ""
  echo -e "${info} $total Subdomains found.${end}"
  echo ""
  crtSH "dicattack"
  else
    echo -e "$error Could not download dictionary from seclists url.$end"
    dictionaryAttackCustom
  fi
}

# DNS Brute Force handler function - Trigger the dictorinary attack
bruteForceDNS(){
  echo -e "
  ██████╗ ██╗ ██████╗ ██████╗████████╗██╗ ██████╗ ███╗   ██╗ █████╗ ██████╗ ██╗   ██╗
  ██╔══██╗██║██╔════╝██╔════╝╚══██╔══╝██║██╔═══██╗████╗  ██║██╔══██╗██╔══██╗╚██╗ ██╔╝
  ██║  ██║██║██║     ██║        ██║   ██║██║   ██║██╔██╗ ██║███████║██████╔╝ ╚████╔╝
  ██║  ██║██║██║     ██║        ██║   ██║██║   ██║██║╚██╗██║██╔══██║██╔══██╗  ╚██╔╝
  ██████╔╝██║╚██████╗╚██████╗   ██║   ██║╚██████╔╝██║ ╚████║██║  ██║██║  ██║   ██║
  ╚═════╝ ╚═╝ ╚═════╝ ╚═════╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝

                   █████╗ ████████╗████████╗ █████╗  ██████╗██╗  ██╗
                  ██╔══██╗╚══██╔══╝╚══██╔══╝██╔══██╗██╔════╝██║ ██╔╝
                  ███████║   ██║      ██║   ███████║██║     █████╔╝
                  ██╔══██║   ██║      ██║   ██╔══██║██║     ██╔═██╗
                  ██║  ██║   ██║      ██║   ██║  ██║╚██████╗██║  ██╗
                  ╚═╝  ╚═╝   ╚═╝      ╚═╝   ╚═╝  ╚═╝ ╚═════╝╚═╝  ╚═╝

  \n\t\t$output_color Fuzzing subdomains of $1[++]$end\n
  ${question}Do yo want to use a custom dictionary? [c=custom/d=default]$end
  $info Default: Provides a dictionary with the top 1000 of the most commonly used subdomains.
  $info Custom: Use your own custom dictionary.$question\n"

  while true; do
    read -rp "[d/c]> " dc
    case $dc in
      [Dd]* ) dictionaryAttack; break;;
      [Cc]* ) dictionaryAttackCustom; break;;
      * ) echo -e "$error Please answer$green D$end \e[1m\e[91mor$end$green\e[1m C$end\e[1m\e[91m.$end\n";;
    esac
  done
}

# Check if the subdomain has webserver
check_web_server() { #8
  local end="\e[0m"
  local cyan="\e[1m\e[36m"
  local ok="\e[1m\e[92m"
  local resalted_output="\e[1;37m"
  local -r webservers_outfile=$(mktemp /tmp/dnsexplorer/XXXX.webservers.txt)

  local response=$(curl -m 3 --head --silent --output /dev/null --write-out '%{http_code}' "http://${1}")
  if ((response >= 100 && response <= 599)); then
    [ "$protocol" == "https" ] && secure=" secure"
    echo -e "${end}The domain ${resalted_output}$1${end} has a web server. [${cyan}HTTP${end}:$ok$response$end]"
    echo "http://$1" >> "$webservers_outfile"
  fi

  local response=$(curl -m 3 --head --silent --output /dev/null --write-out '%{http_code}' "https://${1}")
  if ((response >= 100 && response <= 599)); then
    [ "$protocol" == "https" ] && secure=" secure"
    echo -e "${end}The domain $resalted_output$1$end has a secure web server. [${cyan}HTTPS${end}:$ok$response$end]"
    echo "https://$1" >> "$webservers_outfile"
  fi
}
export -f check_web_server

# Abuse of crt.sh website - Internet connection required.
crtSH(){ #7
  declare -r call_source="$1"

  # Make sure the function is called from another function
  if [ -z "$call_source" ]; then
    echo -e "$error The function 'crtSH' must be called from another function.$end"
    return 1
  fi

  crtshoutput="$tmpdir/crtsh-output.txt" # crt.sh RAW output
  crtsh_parsed_output="$tmpdir/crt.sh.reg" # crt.sh parsed output
  subdomain_file="$output/$DOMAIN.subdomains.txt" # Subdomains results without wildcard
  subdomain_wildcard_file="$output/$DOMAIN.wildcard.txt" # Subdomains results with wildcard
  final_outputfile="$output/$DOMAIN-all.txt" # Final output subdomain file
  webservers_outfile="$output/$DOMAIN.webservers" # Final output subdomain file
  SANs_tmp_file=$(mktemp $tmpdir/XXX.SAN.tmp) # Final output SAN certificates file
  new_SANs="$tmpdir/found_new_SAN.tmp"

  if [ "$call_source" == "dicattack" ];then
    previus_result="$tmpdir/dicctionary.results.txt" # Dictionary attack results
  fi
  if [ "$call_source" == "zonetransfer" ];then
    previus_result="$output/$DOMAIN.zoneTransfer.txt" # Dictionary attack results
    #zonetransfer_tmp_data=$(cat "$previus_result"|  grep -E "([a-zA-Z0-9.-]+)\.$DOMAIN.*" | awk '{print $1}' | sort -u | grep -v '_' | sed 's/\.$//')
    cat "$previus_result" | grep -E "([a-zA-Z0-9.-]+)\.$DOMAIN.*" | awk '{print $1}' | sort -u | grep -v '_' | sed 's/\.$//' > $tmpdir/zonetransfer.results.txt
    zonetransfer_tmp_data="$tmpdir/zonetransfer.results.txt"
  fi
  if [ "$call_source" == "None" ];then
    previus_result="None" # Dictionary attack results
  fi

  echo "" > $subdomain_file && echo "" > $subdomain_wildcard_file && echo "" > $SANs_tmp_file && echo "" > $new_SANs
  echo -e "\n$info Finding subdomains - abusing Certificate Transparency Logs using https://crt.sh/\n$end"

  max_retries=3
  retry_count=0
  crtsh_susscess=1

  while [ $retry_count -lt $max_retries ]; do
    # Make sure we have a valid response
    crtsh_response=$(curl -s -w "%{size_download} %{http_code}" "https://crt.sh/?q=${DOMAIN}&output=json" -o $crtshoutput)
    crtsh_response_size=$(echo $crtsh_response | awk '{print $1}')
    crtsh_response_code=$(echo $crtsh_response | awk '{print $2}')

    if [ "$crtsh_response_size" -gt 2 ] && [ "$crtsh_response_code" -eq 200 ]; then
      real_response_size=$(wc -c < $crtshoutput)

      if [ "$real_response_size" -gt 2 ]; then

      ### INTEGRAR VALIDACION DE SI EL ATAQUE DE DICCIONARIO SE LLEVO A CABO


        grep -o '"common_name":"[^"]*' $crtshoutput | awk -F ':"' '{ print $2 }' | sort -u > $crtsh_parsed_output
        size_crtsh_output=$(wc -l < $crtsh_parsed_output)

        # Filter and sort subdomains only once
        sorted_subdomains=$(sort -u $crtsh_parsed_output)

        # Check if there are wildcard subdomains
        if echo "$sorted_subdomains" | grep -q '^\*\.'; then
          # Calculate the size of the output list - with wildcard
          crtsh_parsed_output_wildcard_size=$(echo "$sorted_subdomains" | grep '^\*\.' | wc -l)

          # Calculate the size of the output list - without wildcard
          crtsh_parsed_output_no_wildcard_size=$(echo "$sorted_subdomains" | grep -v '^\*\.' | wc -l)

          # Save subdomains without wildcard
          echo "$sorted_subdomains" | sed 's/^\*\.//g' > $subdomain_file

          # Save subdomains with wildcard
          echo "$sorted_subdomains" | grep '^\*\.' > $subdomain_wildcard_file

          # Print results
          echo -e "$ok[$resalted_output$crtsh_parsed_output_no_wildcard_size$ok] subdomains found"
          echo -e "$ok[$resalted_output$crtsh_parsed_output_wildcard_size$ok] wildcard subdomains found"
          echo -e "$ok[$resalted_output$size_crtsh_output$ok] total subdomains"
          crtsh_susscess=0
        else
          # Save subdomains without wildcard
          echo "$sorted_subdomains" > $subdomain_file

          # Print results
          echo -e "$info CRTsh results\n[$size_crtsh_output] total subdomains found"
          crtsh_susscess=0
        fi

        if [ "$call_source" == "zonetransfer" ]; then
          cat "$zonetransfer_tmp_data" "$subdomain_wildcard_file" "$subdomain_file" | sed '/^$/d' | sed 's/*\.//g' | sort -u > "$final_outputfile"
        elif [ "$call_source" == "dicattack" ]; then
          cat "$previus_result" "$subdomain_wildcard_file" "$subdomain_file" | sed '/^$/d' | sed 's/*\.//g' | sort -u > "$final_outputfile"
        else
          cat "$subdomain_wildcard_file" "$subdomain_file" | sed '/^$/d' | sed 's/*\.//g' | sort -u > "$final_outputfile"
        fi

        # Calculate the number of threads to use
        count_domains=$(wc -l < "$final_outputfile")
        threads=$(echo "scale=0; ($count_domains * 0.15 + 0.5)/1" | bc)
        [ "$threads" -lt 1 ] && threads=1
        [ "$threads" -gt 25 ] && threads=25

        # Print info
        echo -e "$info Loaded $count_domains targets...$end\n\n"

        # Execute the check_web_server function in parallel
        sort -u "$final_outputfile" | parallel -j "$threads" check_web_server

        break
      else
        echo -e "$error Unable to connect to CTR.sh$end"
        retry_count=$((retry_count + 1))
      fi
    else
      echo -e "$error Unable to connect to CTR.sh$end"
      retry_count=$((retry_count + 1))
    fi
  done

  # if we have reached the max number of retries
  if [ "$max_retries" -eq "$retry_count" ]; then

    # if the previus_result variable is empty and the crtsh was not success
    if [[ "$call_source" == "None" && "$crtsh_susscess" -eq 1 ]]; then

      # No previus result and crtsh was not success, try to enumerate the main domain
      echo -e "$error It was not possible to find subdomains using any conventional enumeration method. Running the extra mile......$end"
      check_web_server "$DOMAIN"
      cat /tmp/dnsexplorer/*.webservers.txt > "$webservers_outfile"
      webservers_count=$(wc -l < $webservers_outfile)

      # Check if there are webservers
      if [ "$webservers_count" -gt 0 ]; then
        echo -e "$ok[$resalted_output$webservers_count$ok] webservers found"
        protocol=$(grep "https://" "$webservers_outfile" | head -1 | awk -F'://' '{print $1}')

        # Check if there are https webservers
        if [ "$protocol" == "https" ]; then
          echo -e "$info Checking for SANs in the certificate$end"
          echo "" > "$SANs_tmp_file"
          grep "https://" "$webservers_outfile" | xargs -I {} -P 1 -n 1 bash -c 'checkCertificateSubjectsAlternativeNames "$1" "$2" "$3"' _ {} 443 "$SANs_tmp_file"

        # Check if there are http webservers
        elif [ "$protocol" == "http" ]; then
          if $EXTENDED_CHECKS;then
            local -r webEnumOutputCSV="$output/$DOMAIN.webenum.csv"
            echo "URL,HTTPServer,IP,PoweredBy,X-Powered-By,Country,WAF" > "$webEnumOutputCSV"

            count_webservers=$(wc -l < "$webservers_outfile")
            threads_webenum=$(echo "scale=0; ($count_webservers * 0.15 + 0.5)/1" | bc)
            [ "$threads_webenum" -lt 1 ] && threads=1
            [ "$threads_webenum" -gt 25 ] && threads=25

            sort -u "$webservers_outfile" | parallel -j "$threads_webenum" webEnum
            cat $tmpdir/whatweb/*.csv >> "$webEnumOutputCSV"

            printResults 0.05
            # FIN
          fi
        fi
      else
        echo -e "$error No webservers found$end"
        printResults 0.05
        clean
        # FIN
      fi
    else

      # Check if the previus result is not empty
      if [ "$call_source" == "zonetransfer" ];then
        echo "$zonetransfer_tmp_data" > "$final_outputfile"
        count_domains=$(wc -l < "$final_outputfile")
        threads=$(echo "scale=0; ($count_domains * 0.15 + 0.5)/1" | bc)
        [ "$threads" -lt 1 ] && threads=1
        [ "$threads" -gt 25 ] && threads=25
        echo -e "$info Loaded $count_domains targets...$end\n\n"
        sort -u "$final_outputfile" | parallel -j "$threads" check_web_server

      # Check if the previus result is not empty
      elif [ "$call_source" == "dicattack" ];then
        cp "$previus_result" "$final_outputfile"
        count_domains=$(wc -l < "$final_outputfile")
        threads=$(echo "scale=0; ($count_domains * 0.15 + 0.5)/1" | bc)
        [ "$threads" -lt 1 ] && threads=1
        [ "$threads" -gt 25 ] && threads=25
        echo -e "$info Loaded $count_domains targets...$end\n\n"
        sort -u "$final_outputfile" | parallel -j "$threads" check_web_server
      fi
    fi
  fi

  # Even if crt.sh has no results, the script takes the data from the source and performs the web server check, even if dicct attacks was not successful.

  # Merge all the webservers files
  cat /tmp/dnsexplorer/*.webservers.txt | sort -u > "$webservers_outfile"
  https_count=$(grep "https://" "$webservers_outfile" | wc -l)
  threads_enumSANs=$(echo "scale=0; ($https_count * 0.15 + 0.5)/1" | bc)
  [ "$threads_enumSANs" -lt 1 ] && threads=1
  [ "$threads_enumSANs" -gt 25 ] && threads=25

  # Check if there are SANs
  grep "https://" "$webservers_outfile" | xargs -I {} -P "$threads_enumSANs" -n 1 bash -c 'checkCertificateSubjectsAlternativeNames "$1" "$2" "$3"' _ {} 443 "$SANs_tmp_file"

  # Discover new SANs
  sort -u $SANs_tmp_file | sed 's/^\*\.//g' | grep -E '.*\.'$domain'\\b' > $new_SANs
  new_subdomains=$(mktemp $tmpdir/XXX.new_subdomains.tmp)
  curated_previus_webservers=$(mktemp $tmpdir/XXX.curated_previus_webservers.tmp)
  cat "$webservers_outfile" | sed 's/http\:\/\///g' | sed 's/https\:\/\///g' | sort -u > $curated_previus_webservers
  grep -Fxv -f $curated_previus_webservers $new_SANs > $new_subdomains
  count_newsubdomains=$(wc -l < $new_subdomains)

  # Print results
  if [ "$count_newsubdomains" -gt 0 ]; then
    echo -e "\n${info}${count_newsubdomains} New subdomains was found${end}"
    cat $new_subdomains
    cat $new_subdomains >> $final_outputfile
  else
    echo -e "\n${cyan}No new subdomains found"
  fi

  webservers_count=$(wc -l < $webservers_outfile)
  subdomains_count=$(wc -l < $final_outputfile)

  # ExtendedChecks
  if $EXTENDED_CHECKS;then
    local -r webEnumOutputCSV="$output/$DOMAIN.webenum.csv"
    echo "URL,HTTPServer,IP,PoweredBy,X-Powered-By,Country,WAF" > "$webEnumOutputCSV"

    # Calculate the number of threads to use and launch the webEnum function in parallel
    count_webservers=$(wc -l < "$webservers_outfile")
    threads_webenum=$(echo "scale=0; ($count_webservers * 0.15 + 0.5)/1" | bc)
    [ "$threads_webenum" -lt 1 ] && threads=1
    [ "$threads_webenum" -gt 25 ] && threads=25
    echo "" # Just a blank line :)
    sort -u "$webservers_outfile" | parallel -j "$threads_webenum" webEnum

    # Merge all the CSV files
    cat $tmpdir/whatweb/*.csv >> "$webEnumOutputCSV"
  fi

  printResults 0.05
}

# Print results function
printResults() {
  delay=$1

  DNSExplorerResults="Domain:${DOMAIN}
      DNS Servers: ${dns_servers_count}
      Zone Transfer: ${zone_transfer}
      Subdomains: ${subdomains_count}
      Webservers: ${webservers_count}"
  echo -e "\e[92;1m"
  for i in $(seq 0 $((${#DNSExplorerResults} - 1))); do
    echo -ne "${DNSExplorerResults:$i:1}"
    sleep "$delay"
  done
  echo -e "\e[0m"  # New line
}

# Extended checks capabilities
webEnum() { #9
  info="\e[36m[+]"
  end="\e[0m"
  if [ -z "$1" ]; then
    return 1
  fi

  if [[ $1 != http://* && $1 != https://* ]]; then
    return 1
  fi

  local -r wafwoof_txt_tmp_output=$(mktemp /tmp/dnsexplorer/wafw00f/XXX.wafw00f)
  local -r output_txt_webenum_file=$(mktemp /tmp/dnsexplorer/whatweb/XXX.csv)

  # Check if the site has a WAF
  wafw00f "$1" -f json -o "$wafwoof_txt_tmp_output" > /dev/null 2>&1
  firewall_detected=$(cat "$wafwoof_txt_tmp_output" | grep -oE '"firewall": "[^"]+"' | awk -F': ' '{gsub(/[",]/, "", $2); print $2}')
  [ -z "$firewall_detected" ] && firewall_detected="None"

  # Check webserver technologies
  local -r ww_result=$(whatweb --no-errors --open-timeout=7 --read-timeout=15 --colour=never "$1" 2>/dev/null)

  echo -e "${info} Testing webserver ${end}$1"

  # Get the webserver technologies
  httpserver=$(echo "$ww_result" | grep -o 'HTTPServer\[[^]]*\]' | cut -d'[' -f2 | cut -d']' -f1)
  [ -z "$httpserver" ] && httpserver="None"
  ip=$(echo "$ww_result" | grep -o 'IP\[[^]]*\]' | cut -d'[' -f2 | cut -d']' -f1 | head -1)
  [ -z "$ip" ] && ip="None"
  poweredby=$(echo "$ww_result" | grep -o 'PoweredBy\[[^]]*\]' | cut -d'[' -f2 | cut -d']' -f1)
  [ -z "$country" ] && country="None"
  xpoweredby=$(echo "$ww_result" | grep -o 'X-Powered-By\[[^]]*\]' | cut -d'[' -f2 | cut -d']' -f1)
  [ -z "$poweredby" ] && poweredby="None"
  country=$(echo "$ww_result" | grep -o 'Country\[[^]]*\]' | cut -d'[' -f2 | cut -d']' -f1)
  [ -z "$xpoweredby" ] && xpoweredby="None"

  # Save results
  echo "\"$1\",\"$httpserver\",\"$ip\",\"$poweredby\",\"$xpoweredby\",\"$country\",\"$firewall_detected\"" > "$output_txt_webenum_file"
}
export -f webEnum

# Funcion for checking if the site has Subject Alternative Names
checkCertificateSubjectsAlternativeNames() { #6
  port=$2
  declare output_file="$3"

  if [ -z "$1" ]; then
    return 1
  fi

  if [ -z "$port" ]; then
    port=443
  fi

  if [ -z "$output_file" ]; then
    return 1
  fi

  server=$(echo "$1" | sed 's/http:\/\///' | sed 's/https:\/\///' | sed 's/\/$//')

  # Make sure opnessl can connect to the site
  connected=$(echo -n | openssl s_client -connect  "$server:$port" 2>/dev/null | head -1 | awk -F "(" '{print $1}')

  # Check if the site has a webserver
  if [[ "$connected" == "CONNECTED" ]];then

    # Check if the site has DNS names
    DNS=$(echo -n | openssl s_client -connect "$server:$port" 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text 2> /dev/null | sed 's/\                //'|grep -i "DNS:" | awk -F ":" '{print $1}')

    # Make sure the site has DNS names
    if [[ "$DNS" == "DNS" ]];then

      # Get the number of Subject Alternative Names
      len_subjects=$(echo -n | openssl s_client -connect "$server:$port" 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text 2>/dev/null | grep "DNS:" 2>/dev/null | tr ',' '\n' | sed 's/\               //' | wc -l)

      # Check if the site has almost one Subject Alternative Names
      if [ $len_subjects -ge 1 ];then

        # Get the Subject Alternative Names
        SANs=$(echo -n | openssl s_client -connect "$server:$port" 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | openssl x509 -text | grep "DNS:"| tr ',' '\n' | sed 's/\               //' | sed 's/\s//g' | sed 's/DNS://g')

        # return the Subject Alternative Names
        echo "$SANs" >> "$output_file"
      else
        return 1
      fi
    else
      return 1
    fi
  else
    return 1
  fi
}
export -f checkCertificateSubjectsAlternativeNames

# Initial recon
initHostRecon(){ #3
  echo -e "\n${info} A records for ${resalted_output}${DOMAIN}${end}${cyan} domain${end}"
  # A Records
  host "$DOMAIN" | grep 'has address' | awk '{print $4}'

  echo -e "\n${info} AAA records for ${resalted_output}${DOMAIN}${end}${cyan} domain${end}"
  # AAA Records
  if host "$DOMAIN" | grep 'IPv6' >/dev/null 2>&1;then
    host "$DOMAIN" | grep 'IPv6'| awk '{print $5}'
  else
    echo -e "$question Hosts $DOMAIN has not IPv6 address"
  fi

  echo -e "\n${info} MX records for ${resalted_output}${DOMAIN}${end}${cyan} domain${end}"
  # MAIL Records
  if host -t MX "$DOMAIN" | grep 'mail' >/dev/null 2>&1;then
    host "$DOMAIN" | grep 'mail' | awk '{print $6,$7}'
  else
    echo -e "$question Hosts $DOMAIN has not mail server records\n"
  fi

  echo -e "\n${info} CNAME records for ${resalted_output}${DOMAIN}${end}${cyan} domain${end}"
  # CNAME Records
  if host -t CNAME "$DOMAIN" | grep 'alias' >/dev/null 2>&1;then
    host -t CNAME "$DOMAIN" | awk '{print $1,$4,$6}'
  else
    echo -e "$question Hosts $DOMAIN has not alias records"
  fi

  echo -e "\n${info} TXT records for ${resalted_output}${DOMAIN}${end}${cyan} domain${end}"
` # TXT Records`
  if host -t txt "$DOMAIN" | grep 'descriptive' >/dev/null 2>&1;then
    host -t txt "$DOMAIN" | grep 'descriptive'
  else
    echo -e "$question Hosts $DOMAIN has not description records\n"
  fi
}

# Zone transfer attack function
doZoneTransfer(){ #4
  success=1
  if host -t NS "$DOMAIN" | grep 'name server' >/dev/null 2>&1;then
    echo -e "\n${info} Enumerating DNS Servers..."
    host -t NS "$DOMAIN" | cut -d " " -f 4 > $tmpdir/NameServers.txt

    ns=$(wc -l $tmpdir/NameServers.txt | awk '{print $1}')

    if [ $ns -ge 1 ];then
      echo -e "    ${green}[${ns}] DNS Servers was found, trying ZoneTransfer on these servers${end}"
      dns_servers_count=$ns

      # Verify if the DNS servers accept zone transfer
      while IFS= read -r nameserver;do
        host -t axfr "$DOMAIN" "$nameserver" | grep -E 'Received ([0-9]+) bytes from [0-9\.]+#[0-9]+ in ([0-9]+) ms' >/dev/null 2>&1

        if [ $? -eq 0 ];then
          axfr_tmp_file="$tmpdir/axfr.tmp" && echo "" > "$axfr_tmp_file"
          axfr_parsed_file="$tmpdir/parsed_axfr.tmp" && echo "" > "$axfr_tmp_file"
          host -t axfr "$DOMAIN" "$nameserver" > "$axfr_tmp_file"
          declare -a record_types=("A" "AAA" "AXFR" "CNAME" "MX" "NS" "SOA" "SRV" "TXT")
          total_records=0
          success=0

          # SHow blinking message
          for i in {1..3}; do
            echo -ne "${ok}\e[5;7mNameServer ${nameserver} accept ZoneTransfer\e[0m"
            sleep 0.5
            echo -ne "\r\e[K"
            sleep 0.5
          done

          for record_type in "${record_types[@]}"; do
            # Extract the current records of the current type
            current_records=$(cat "$axfr_tmp_file" | grep "IN[[:space:]]\+$record_type" | sort -u | awk '{print $1 "\t" $NF}' | column -t -s $'\t')

            # Verify if there are records of the current type
            if [ -n "$current_records" ]; then
              count_current_records=$(cat "$axfr_tmp_file" | grep "IN[[:space:]]\+$record_type" | sort -u | wc -l)
              echo -e "${info} ${count_current_records} '$record_type' records found:${end}\n$current_records\n"
              echo -e "$current_records" >> "$axfr_parsed_file"
              total_records=$((total_records + count_current_records))
            fi
          done
          echo -e "${ok}[${total_records}] Records found in $nameserver$end\nPlease take note of the other DNS servers, they may do zone transfers as well.${end}"
          break
        else
          echo -e "    $error NameServer $nameserver does not accept zone transfer$end"
        fi
      done < <(grep -v '^ *#' < $tmpdir/NameServers.txt)
    else
      echo -e "$error No DNS servers found for $DOMAIN$end"
    fi

    # Check if the zone transfer was successful
    if [ $success -eq 0 ];then
      echo -e "\n$ok DNS zone transfer was possible, no bruteforce attacks on the subdomains are required. $end\n"

      cp "$axfr_parsed_file" $output/$DOMAIN.zoneTransfer.txt
      zone_transfer="Yes"
      crtSH "zonetransfer"
      clean

    # If the zonetransfer was not successful, then call to bruteforce
    else
      echo -e "\n$error DNS zone transfer was not possible, DNS servers are not accept it"

      while true; do
        echo ""
        tput cnorm
        echo -e "$question"
        read -rp "Do you want to brute force subdomains? [Y/n]> " yn
        echo -e "$end"

        case $yn in
          [Yy]* ) bruteForceDNS; clean; break;;
          [Nn]* ) crtSH "None"; clean;;
          * ) echo -e "$error Please answer yes or no.$end\n";;
        esac
      done
    fi
  fi
}

# Init recon with 'host' command
basicRecon(){  #2
  initHostRecon
  doZoneTransfer
}

# Check dependencies: curl, host, parallel.
checkDependencies() {
  declare -A dependencies=(
    ["host"]="bind-utils/dnsutils"
    ["curl"]="curl"
    ["parallel"]="Parallel"
    ["bc"]="BC"
  )
  for cmd in "${!dependencies[@]}"; do
    if ! command -v "$cmd" &> /dev/null; then
      echo -e "$error '$cmd' command is not available, please install the ${dependencies[$1]} package. $end"
        clean
    fi
  done
}

# Check opt dependencies: wafw00f, whatweb.
optDependencies() {
  declare -A dependencies=(
    ["whatweb"]="whatweb"
    ["wafw00f"]="wafw00f"
  )
  for cmd in "${!dependencies[@]}"; do
    if ! command -v "$cmd" &> /dev/null; then
      echo -e "$error '$cmd' command is not available, please install the ${dependencies[$1]} package for extended checks. $end"
        clean
    fi
  done
}

banner(){
    echo -e "\e[91m
        ▓█████▄  ███▄    █   ██████ ▓█████ ▒██   ██▒ ██▓███   ██▓     ▒█████   ██▀███  ▓█████  ██▀███
        ▒██▀ ██▌ ██ ▀█   █ ▒██    ▒ ▓█   ▀ ▒▒ █ █ ▒░▓██░  ██▒▓██▒    ▒██▒  ██▒▓██ ▒ ██▒▓█   ▀ ▓██ ▒ ██▒
        ░██   █▌▓██  ▀█ ██▒░ ▓██▄   ▒███   ░░  █   ░▓██░ ██▓▒▒██░    ▒██░  ██▒▓██ ░▄█ ▒▒███   ▓██ ░▄█ ▒
        ░▓█▄   ▌▓██▒  ▐▌██▒  ▒   ██▒▒▓█  ▄  ░ █ █ ▒ ▒██▄█▓▒ ▒▒██░    ▒██   ██░▒██▀▀█▄  ▒▓█  ▄ ▒██▀▀█▄
        ░▒████▓ ▒██░   ▓██░▒██████▒▒░▒████▒▒██▒ ▒██▒▒██▒ ░  ░░██████▒░ ████▓▒░░██▓ ▒██▒░▒████▒░██▓ ▒██▒
        ▒▒▓  ▒ ░ ▒░   ▒ ▒ ▒ ▒▓▒ ▒ ░░░ ▒░ ░▒▒ ░ ░▓ ░▒▓▒░ ░  ░░ ▒░▓  ░░ ▒░▒░▒░ ░ ▒▓ ░▒▓░░░ ▒░ ░░ ▒▓ ░▒▓░
        ░ ▒  ▒ ░ ░░   ░ ▒░░ ░▒  ░ ░ ░ ░  ░░░   ░▒ ░░▒ ░     ░ ░ ▒  ░  ░ ▒ ▒░   ░▒ ░ ▒░ ░ ░  ░  ░▒ ░ ▒░
        ░ ░  ░    ░   ░ ░ ░  ░  ░     ░    ░    ░  ░░         ░ ░   ░ ░ ░ ▒    ░░   ░    ░     ░░   ░
        ░             ░       ░     ░  ░ ░    ░               ░  ░    ░ ░     ░        ░  ░   ░
      v:2.0 ░ $end By: Danilo Basanta (https://github.com/dabasanta/) ░ (https://www.linkedin.com/in/danilobasanta/)\n\n


\033[3mThe author does not promote malicious actions or the use of the script for illegal operations. Remember to always obtain prior permission from the target company's system administrators before performing any malicious actions.\033[0m\n\n"
}

help(){ # Simply help function
    echo -e "\e[91m
        @@@  @@@  @@@@@@@@  @@@       @@@@@@@
        @@@  @@@  @@@@@@@@  @@@       @@@@@@@@
        @@!  @@@  @@!       @@!       @@!  @@@
        !@!  @!@  !@!       !@!       !@!  @!@
        @!@!@!@!  @!!!:!    @!!       @!@@!@!
        !!!@!!!!  !!!!!:    !!!       !!@!!!
        !!:  !!!  !!:       !!:       !!:
        :!:  !:!  :!:        :!:      :!:
        ::   :::   :: ::::   :: ::::   ::
        :   : :  : :: ::   : :: : :   :
v:2.0   ░ By: Danilo Basanta (https://github.com/dabasanta/) ░ (https://www.linkedin.com/in/danilobasanta/)\n\n${end}
"

    options=$(cat <<- EOM
${resalted_output}Usage:${end}        ${green}\e[3m./DNSExplorer.sh <domain>${end}

${resalted_output}Extended:${end}     ${green}\e[3m./DNSExplorer.sh <domain> --extended${end}

${resalted_output}Help:${end}         ${green}\e[3m-h, --help Display this help and exit${end}

EOM
    )
echo -e "$options"
tput cnorm
}

main(){ #1
  export output="$DOMAIN.out"
  mkdir -p $output

  banner
  checkDependencies
  if ping -c 1 "$DOMAIN" > /dev/null 2>&1;then
      if host "$DOMAIN" > /dev/null 2>&1;then
          basicRecon "$DOMAIN"
      else
          echo -e "$error No route to host, please verify your DNS server or internet connection$end"
          clean
      fi
  else
      echo -e "${question}PING was not success, does server ignoring ICMP packets?$end"
      if host "$DOMAIN" > /dev/null 2>&1;then
          echo -e "${info}Running checks anyway$end\n"
          basicRecon "$DOMAIN"
      else
          echo -e "$error No route to host, please verify your DNS server or internet connection$end"
          clean
      fi
  fi
}

# Init  flow
if [ "$1" = "-h" ] || [ "$1" = "help" ] || [ "$1" = "--help" ] || [ "$2" = "-h" ] || [ "$2" = "--help" ] || [ "$2" = "help" ]; then
  help
elif [ $# -eq 2 ]; then

  # Check if the second parameter is --extended
  if [ "$2" = "--extended" ]; then
    DOMAIN=$1
    EXTENDED_CHECKS=true
    optDependencies
    main "$DOMAIN"
  else
    echo -e "$error Parameter '$2' is not recognized $end"
    help
    tput cnorm
    exit 1
  fi
elif [ $# -eq 0 ]; then
  help
  tput cnorm
  exit 1
else
  DOMAIN=$1
  main "$DOMAIN"
fi