PCTAMALOU

🔬 Mission pratique – Laboratoire (2 heures)

Architecture du Laboratoire Scripting

⚠️ Environnement de Développement

# Vérifier Python3
python3 --version  # Doit être 3.8+

# Créer environnement virtuel (bonne pratique)
python3 -m venv ~/mon_lab/python_avance/venv
source ~/mon_lab/python_avance/venv/bin/activate

# Installation bibliothèques
pip install requests beautifulsoup4 aiohttp colorama

Étapes Détaillées de Développement

Étape 1 : Subdomain Enumeration Avancée

#!/usr/bin/env python3
"""
subdomain_enum.py - Énumération avancée de sous-domaines
Usage: python3 subdomain_enum.py -d example.com -w wordlist.txt -t 20
"""

import argparse
import requests
import sys
from concurrent.futures import ThreadPoolExecutor, as_completed
from urllib.parse import urlparse
import time
import json
from colorama import init, Fore, Style

init(autoreset=True)  # Couleurs terminal

class SubdomainEnumerator:
    def __init__(self, domain, wordlist, threads=10, timeout=5, 
                 user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)"):
        self.domain = domain
        self.wordlist = wordlist
        self.threads = threads
        self.timeout = timeout
        self.headers = {'User-Agent': user_agent}
        self.results = []
        self.session = requests.Session()
        
    def check_subdomain(self, subdomain):
        """Vérifie un sous-domaine avec plusieurs techniques"""
        url_http = f"http://{subdomain}.{self.domain}"
        url_https = f"https://{subdomain}.{self.domain}"
        
        techniques = [
            (url_https, "HTTPS"),
            (url_http, "HTTP")
        ]
        
        for url, protocol in techniques:
            try:
                response = self.session.head(
                    url, 
                    timeout=self.timeout, 
                    headers=self.headers,
                    allow_redirects=True
                )
                
                if response.status_code < 400:
                    # Récupère le titre si c'est une page HTML
                    if 'text/html' in response.headers.get('Content-Type', ''):
                        try:
                            full_resp = self.session.get(
                                url, 
                                timeout=self.timeout,
                                headers=self.headers
                            )
                            from bs4 import BeautifulSoup
                            soup = BeautifulSoup(full_resp.text, 'html.parser')
                            title = soup.title.string.strip() if soup.title else "No title"
                        except:
                            title = "Unknown"
                    else:
                        title = response.headers.get('Content-Type', 'Unknown')
                    
                    result = {
                        'subdomain': f"{subdomain}.{self.domain}",
                        'url': url,
                        'protocol': protocol,
                        'status_code': response.status_code,
                        'title': title,
                        'server': response.headers.get('Server', 'Unknown'),
                        'content_length': response.headers.get('Content-Length', 'Unknown')
                    }
                    
                    self.results.append(result)
                    
                    # Affichage coloré
                    color = Fore.GREEN if response.status_code == 200 else Fore.YELLOW
                    print(f"{color}[+] {result['subdomain']} ({protocol}) - {response.status_code} - {result['title']}")
                    
                    return result
                    
            except requests.exceptions.SSLError:
                print(f"{Fore.YELLOW}[!] SSL Error for {subdomain}.{self.domain}")
            except requests.exceptions.ConnectionError:
                pass  # Silence pour connexion refusée
            except requests.exceptions.Timeout:
                print(f"{Fore.RED}[!] Timeout for {subdomain}.{self.domain}")
            except Exception as e:
                print(f"{Fore.RED}[!] Error for {subdomain}.{self.domain}: {e}")
        
        return None
    
    def load_wordlist(self):
        """Charge la wordlist avec gestion d'erreurs"""
        try:
            with open(self.wordlist, 'r', encoding='utf-8', errors='ignore') as f:
                return [line.strip() for line in f if line.strip()]
        except FileNotFoundError:
            print(f"{Fore.RED}[!] Wordlist {self.wordlist} non trouvée")
            sys.exit(1)
    
    def run(self):
        """Exécute l'énumération"""
        print(f"{Fore.CYAN}[*] Démarrage énumération pour {self.domain}")
        print(f"{Fore.CYAN}[*] Threads: {self.threads}, Timeout: {self.timeout}s")
        
        subdomains = self.load_wordlist()
        print(f"{Fore.CYAN}[*] {len(subdomains)} sous-domaines à tester")
        
        start_time = time.time()
        
        with ThreadPoolExecutor(max_workers=self.threads) as executor:
            futures = {
                executor.submit(self.check_subdomain, sub): sub 
                for sub in subdomains[:100]  # Limite pour démonstration
            }
            
            for future in as_completed(futures):
                subdomain = futures[future]
                try:
                    future.result(timeout=self.timeout + 2)
                except Exception as e:
                    print(f"{Fore.RED}[!] Exception pour {subdomain}: {e}")
        
        elapsed = time.time() - start_time
        print(f"{Fore.CYAN}[*] Scan terminé en {elapsed:.2f} secondes")
        print(f"{Fore.CYAN}[*] {len(self.results)} sous-domaines trouvés")
        
        return self.results
    
    def save_results(self, filename="subdomains.json"):
        """Sauvegarde les résultats en JSON"""
        with open(filename, 'w') as f:
            json.dump(self.results, f, indent=2)
        print(f"{Fore.GREEN}[+] Résultats sauvegardés dans {filename}")

def main():
    parser = argparse.ArgumentParser(description="Énumération avancée de sous-domaines")
    parser.add_argument("-d", "--domain", required=True, help="Domaine cible")
    parser.add_argument("-w", "--wordlist", required=True, help="Fichier wordlist")
    parser.add_argument("-t", "--threads", type=int, default=10, help="Nombre de threads")
    parser.add_argument("-o", "--output", help="Fichier de sortie JSON")
    parser.add_argument("--timeout", type=int, default=5, help="Timeout des requêtes")
    
    args = parser.parse_args()
    
    enumerator = SubdomainEnumerator(
        domain=args.domain,
        wordlist=args.wordlist,
        threads=args.threads,
        timeout=args.timeout
    )
    
    results = enumerator.run()
    
    if args.output:
        enumerator.save_results(args.output)
    else:
        enumerator.save_results()

if __name__ == "__main__":
    main()Copier

# Téléchargement wordlist
wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/DNS/subdomains-top1million-5000.txt

# Exécution avec options
python3 subdomain_enum.py -d example.com -w subdomains-top1million-5000.txt -t 20 -o results.json

# Test sur cible locale (DVWA)
python3 subdomain_enum.py -d 192.168.56.102 -w subdomains-top1million-5000.txt -t 5

Étape 2 : Directory Buster Intelligent

#!/usr/bin/env python3
"""
directory_buster.py - Bruteforce intelligent de répertoires
"""

import requests
from concurrent.futures import ThreadPoolExecutor
import argparse
from urllib.parse import urljoin
from bs4 import BeautifulSoup

class DirectoryBuster:
    def __init__(self, base_url, wordlist, extensions=[".php", ".html", ".txt", ".bak"]):
        self.base_url = base_url.rstrip('/')
        self.wordlist = wordlist
        self.extensions = extensions
        self.found = []
        self.session = requests.Session()
        
    def check_directory(self, path):
        """Vérifie un répertoire/path"""
        # Test sans extension
        url = f"{self.base_url}/{path}"
        response = self.session.get(url, timeout=5)
        
        if response.status_code == 200:
            self.found.append({
                'url': url,
                'status': 200,
                'title': self.extract_title(response.text),
                'size': len(response.content)
            })
            print(f"[+] 200: {url}")
            
            # Extraction liens pour crawling récursif
            self.extract_links(response.text, url)
            
        # Test avec extensions
        for ext in self.extensions:
            url_ext = f"{url}{ext}"
            try:
                resp_ext = self.session.get(url_ext, timeout=3)
                if resp_ext.status_code == 200:
                    self.found.append({
                        'url': url_ext,
                        'status': 200,
                        'title': self.extract_title(resp_ext.text),
                        'size': len(resp_ext.content)
                    })
                    print(f"[+] 200: {url_ext}")
            except:
                pass
    
    def extract_title(self, html):
        """Extrait le titre de la page HTML"""
        soup = BeautifulSoup(html, 'html.parser')
        title = soup.title
        return title.string if title else "No title"
    
    def extract_links(self, html, base_url):
        """Extrait les liens pour crawling récursif"""
        soup = BeautifulSoup(html, 'html.parser')
        for link in soup.find_all('a', href=True):
            href = link['href']
            if href.startswith('/'):
                full_url = urljoin(base_url, href)
                # Ajouter à la wordlist pour vérification
                # (implémentation avancée)
    
    def run(self):
        """Exécute le scan"""
        with open(self.wordlist, 'r') as f:
            paths = [line.strip() for line in f if line.strip()]
        
        with ThreadPoolExecutor(max_workers=10) as executor:
            for path in paths:
                executor.submit(self.check_directory, path)
        
        print(f"\n[*] Scan terminé. {len(self.found)} répertoires trouvés.")
        return self.found

# Utilisation
if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("-u", "--url", required=True)
    parser.add_argument("-w", "--wordlist", required=True)
    args = parser.parse_args()
    
    buster = DirectoryBuster(args.url, args.wordlist)
    results = buster.run()Copier

Étape 3 : API Discovery Tool

Exercice Avancé : Intégration avec le Projet

mon_scanner/
├── __init__.py
├── scanner.py          # Classe mère
├── modules/
│   ├── subdomain.py
│   ├── directory.py
│   ├── api.py
│   └── portscan.py
├── utils/
│   ├── helpers.py
│   ├── loggers.py
│   └── exporters.py
└── config/
    └── settings.yaml

Bonnes Pratiques de Développement