Knock Subdomain Scan v5.0.0

Knockpy is a python3 tool designed to enumerate subdomains on a target domain through dictionary attack.

Very simply

$ knockpy domain.com

Install

$ git clone https://github.com/guelfoweb/knock.git

edit knockpy/config.json add your virustotal API_KEY

"api": {
		"virustotal": "YOUR VIRUSTOTAL API_KEY HERE"
	},

save.

$ sudo python setup.py install

Knockpy -h

$ knockpy -h
usage: knockpy [-h] [-v] [--no-local] [--no-remote] [--no-http] [-w WORDLIST] [-o FOLDER] [-t SEC] domain

positional arguments:
  domain         target to scan

optional arguments:
  -h, --help     show this help message and exit
  -v, --version  show program's version number and exit
  --no-local     local wordlist ignore
  --no-remote    remote wordlist ignore
  --no-http      http requests ignore

  --no-http-code CODE [CODE ...]
                 http code list to ignore

  -w WORDLIST    wordlist file to import
  -o FOLDER      report folder to store json results
  -t SEC         timeout in seconds

Usage

Full scan

$ knockpy domain.com

Attack type: dns + http(s) requests
Knockpy uses internal file wordlist.txt. If you want to use an external dictionary you can use the -w option and specify the path to your dictionary text file.
Knockpy also tries to get subdomains from google, duckduckgo, and virustotal. The results will be added to the general dictionary.
It is highly recommended to use a virustotal API_KEY which you can get for free. The best results always come from virustotal.
But, if you only want to work with local word lists, without search engines queries, you can add --no-remote to bypass remote recon.
If you want to ignore http(s) responses with specific code, you can use the --no-http-code option followed by the code list 404 500 530

Fast scan

$ knockpy domain.com --no-http

Attack type: dns
DNS requests only, no http(s) requests will be made. This way the response will be much faster and you will get the IP address and the Subdomain.
The subdomain will be cyan in color if it is an alias and in that case the real host name will also be provided.

Set timeout

$ knockpy domain.com -t 5

default timeout = 3 seconds.

Show report

$ knockpy domain.com_yyyy_mm_dd_hh_mm_ss.json

Show the report in the terminal.

Output folder

$ knockpy domain.com -o /path/to/new/folder

All scans are saved in the default folder knock_report that you can edit in the config.json file.
Alternatively, you can use the -o option to define the new folder path.

License

Knockpy is currently under development by @guelfoweb and it's released under the GPL 3 license.

the-robots / knock