About Domain Analyzer
Domain
Analyzer is a powerful security analysis tool for domain security that finds and reports information related to a given domain name in an automated fashion. The main purpose of this project is to help researchers analyze the security issues of target domain names in an unattended manner. In addition to this, the tool also includes many other functions, such as getting more domain names from the DNS space, automated Nmap and web crawlers, etc.
If you want Nmap to scan more ports, or run scripts, or run web crawlers on target sites, you also need root privileges.
Features
Domain
Analyzer can look for information related to a given domain name, such as DNS servers, mail servers, IP addresses, Google mail, SPF information, and more. Once the above information is captured and stored, the tool scans the ports of each IP discovered using Nmap and performs several other security checks. Once it finds the port, it uses the crawler.py script developed by @verovaleros to crawl all web pages of all web ports.
It is worth mentioning that the tool is also capable of downloading files and looking for open directories.
Tool download
The tool is developed based on Python, so we first need to install and configure the Python environment on the local device. Next, researchers can use the following command to clone the project source code locally:
git clone https://github.com/eldraco/domain_analyzer.git
Then use the pip command and the requirements.txt file provided by the project to install the dependent components required by the tool:
pip install -r requirements.txt
Docker image
Docker image (Python 3)
Domain Analyzer provides a Docker image, which is developed based on Python 3 and has all dependent components installed:
docker run --rm -ti verovaleros/domain_analyzer:latest /domain_analyzer/domain_analyzer.py -d <domain>
Docker image (Python 2.7)
Domain Analyzer also provides a Docker image developed based on Python 2.7, and all dependent components are installed:
docker run --rm -it verovaleros/domain_analyzer:python2.7 /domain_analyzer/domain_analyzer.py -d <domain>
Example of tool usage
Then find ten .gov domains and do a full analysis (including web resource crawling), and if zone transfers are found, use them and find more domains through Robtex:
domain_analyzer.py -d .gov -k 10 -b
Look for domain names related to .edu.cn and store all data in the directory. Do not look for live hosts, do not scan with Nmap, do not search emails, do not perform a reverse DNS scan of the target network:
domain_analyzer.py -d edu.cn -b -o -g -a -n
Complete analysis of the 386.edu.ru domain name:
domain_analyzer.py -d 386.edu.ru -b -o
Crawls 100 URLs (including self domains) of the target site, stores the output to a file, and downloads all valuable files to disk:
crawler.py -u www.386.edu.ru -w -s -m 100 -f
Quickly crawl the target site without downloading the file, and store the data in the file:
crawler.py -u www.386.edu.ru -w -m 20
Output in Verbose mode, print out the extension of the downloaded file, and only download the document with the corresponding suffix (.doc, .docx, .ppt, .xls, .odt, etc.):
at last
Share a quick way to learn [Network Security], "maybe" the most comprehensive learning method:
1. Network security theoretical knowledge (2 days)
① Understand the industry-related background, prospects, and determine the development direction.
②Learn laws and regulations related to network security.
③The concept of network security operation.
④Multiple guarantee introduction, guarantee regulations, procedures and norms. (Very important)
2. Penetration testing basics (one week)
①Penetration testing process, classification, standards
②Information collection technology: active/passive information collection, Nmap tools, Google Hacking
③Vulnerability scanning, vulnerability utilization, principles, utilization methods, tools (MSF), Bypass IDS and anti-virus reconnaissance
④ Host attack and defense drill: MS17-010, MS08-067, MS10-046, MS12-20, etc.
3. Operating system basics (one week)
①Common functions and commands of Windows system
②Common functions and commands of Kali Linux system
③Operating system security (system intrusion troubleshooting/system reinforcement basis)
4. Computer network foundation (one week)
①Computer network foundation, protocol and architecture
②Network communication principle, OSI model, data forwarding process
③Common protocol analysis (HTTP, TCP/IP, ARP, etc.)
④Network attack technology and network security defense technology
⑤Web vulnerability principle and defense: active/passive attack, DDOS attack, CVE vulnerability recurrence
5. Basic database operations (2 days)
①Database basics
②SQL language basics
③Database security reinforcement
6. Web penetration (1 week)
①Introduction to HTML, CSS and JavaScript
②OWASP Top10
③Web vulnerability scanning tools
④Web penetration tools: Nmap, BurpSuite, SQLMap, others (chopper, missing scan, etc.)
Congratulations, if you learn this, you can basically work in a network security-related job, such as penetration testing, web penetration, security services, security analysis and other positions; if you learn the security module well, you can also work as a security engineer. The salary range is 6k-15k.
So far, about a month. You've become a "script kiddie". So do you still want to explore further?
Friends who want to get involved in hacking & network security, I have prepared a copy for everyone: 282G, the most complete network security data package on the entire network, for free!
Scan the QR code below and get it for free
With these foundations, if you want to study in depth, you can refer to the super-detailed learning roadmap below. Learning according to this route is enough to support you to become an excellent intermediate and senior network security engineer:
High-definition learning roadmap or XMIND file (click to download the original file)
There are also some video and document resources collected in the study, which can be taken by yourself if necessary:
supporting videos for each growth path corresponding to the section:
of course, in addition to supporting videos, various documents, books, materials & tools are also organized for you , and has helped everyone to classify.
Due to the limited space, only part of the information is displayed. If you need it, you can [scan the QR code below to get it for free]