Awesome Open Source
Awesome Open Source

Python Version GitHub release License Issues Twitter Follow

HostHunter v1.6

A tool to efficiently discover and extract hostnames providing a large set of target IP addresses. HostHunter utilises simple OSINT techniques to map IP addresses with virtual hostnames. It generates a CSV or TXT file containing the results of the reconnaissance.

Latest version of HostHunter also takes screenshots of the target web applicatiinos. This functionality is currently in beta.

Demo

asciicast

Click on the thumbnail above to view the demo.

Installation

  • Tested with Python 3.7.2.

Linux / Mac OS

  • Install python dependencies.
$ pip3 install -r requirements.txt

The next few steps are only required if you would like to use the Screen Capture feature.

  • Download and install the latest version of Google Chrome.

Mac OS:

$ brew cask install google-chrome

Linux:


$ wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb

$ dpkg -i ./google-chrome-stable_current_amd64.deb

$ sudo apt-get install -f
  • Download and install the latest ChromeDriver.

Mac OS:

wget -O /tmp/chromedriver.zip https://chromedriver.storage.googleapis.com/74.0.3729.6/chromedriver_mac64.zip && sudo unzip /tmp/chromedriver.zip chromedriver -d /usr/local/bin/;

Linux:

wget -O /tmp/chromedriver.zip https://chromedriver.storage.googleapis.com/74.0.3729.6/chromedriver_linux64.zip && sudo unzip /tmp/chromedriver.zip chromedriver -d /usr/local/bin/;

Simple Usage Example

$ python3 hosthunter.py <targets.txt>
$ cat vhosts.csv

More Examples

HostHunter Help Page

$ python3 ./hosthunter.py targets.txt -h
usage: hosthunter.py [-h] [-f FORMAT] [-o OUTPUT] [-sc] [-t TARGET] [-V] [targets]

[?] HostHunter v1.6 - Help Page

positional arguments:
  targets               Sets the path of the target IPs file.

optional arguments:
  -h, --help            show this help message and exit
  -f FORMAT, --format FORMAT
                        Choose between CSV and TXT output file formats.
  -o OUTPUT, --output OUTPUT
                        Sets the path of the output file.
  -sc, --screen-capture
                        Capture a screenshot of any associated Web Applications.
  -t TARGET, --target TARGET
                        Scan a Single IP.
  -V, --version         Displays the current version.

Author: Andreas Georgiou (@superhedgy)

Run HostHunter Screen Capture module and output a Nessus file:

$ python3 hosthunter.py <targets.txt> -sc -f csv -o hosts.csv

Display Results

$ cat hosts.csv

View Screenshots

$ open ./screen_captures/

Features

  • [x] Works with Python3
  • [x] Extracts information from SSL/TLS certificates.
  • [x] Supports Free HackerTarget API requests.
  • [x] Takes Screenshots of the target applications.
  • [x] Validates the targets IPv4 address.
  • [x] Supports .txt and .csv output file formats
  • [x] Gathers information from HTTP headers.
  • [x] Verifies Internet access.
  • [x] Retrieves hostname values from services at 21/tcp, 25/tcp, 80/tcp and 443/tcp ports.
  • [x] Supports Nessus target format output.

Coming Next

  • [ ] Improve output (IPs, HostNames, FQDNs)
  • [ ] Pause and Resume Execution
  • [ ] Support for a Premium HackerTarget API key
  • [ ] Support for IPv6
  • [ ] Gather information from additional APIs
  • [ ] Actively pull SSL certificates from other TCP ports

Notes

  • Free APIs throttle the amount of requests per day per source IP address.

License

This project is licensed under the MIT License.

Authors

  • Andreas Georgiou - follow me on twitter - @superhedgy

StarGazers

Thank you for all the support & feedback! Stargazers over time


Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Python (1,143,903
Python3 (33,410
Open Source (7,816
Tool (6,471
Hacking (2,462
Security Tools (1,752
Pentesting (1,386
Hacking Tool (923
Ip (847
Penetration Testing (840
Bugbounty (799
Osint (780
Reconnaissance (346
Recon (308
Network Security (234
Virtual Hosts (70
Hostname (69
Scoping (6
Related Projects