# Subdomain Enumeration ## Bu darsda **Subdomain Enumeration** — pentestingning razvedka bosqichida eng samarali texnikalardan biri. Brute force usulida subdomenlarni topish, wordlist bilan ishlash, goroutine'lar bilan parallel skanerlash va wildcard detection — barchasini amaliy kod bilan ko'ramiz. ## Nima uchun subdomenlar muhim? Kompaniyaning asosiy sayti (`example.com`) odatda yaxshi himoyalangan. Lekin test, dev, eski versiyalar ko'pincha unutiladi: | Subdomen | Xavf darajasi | |---|---| | `www.example.com` | Past — asosiy sayt, yaxshi himoyalangan | | `mail.example.com` | O'rtacha — SMTP zaifliklar bo'lishi mumkin | | `api.example.com` | Yuqori — autentifikatsiya zaif bo'lishi mumkin | | `dev.example.com` | Juda yuqori — debug mode, zaif konfiguratsiya | | `staging.example.com` | Juda yuqori — production ma'lumotlar bo'lishi mumkin | | `old-admin.example.com` | Kritik — unutilgan, himoyasiz | Real voqea: 2019-yil Capital One buzilishi — hujumchi `test-api.capitalone.com` subdomenidan kirgan. 100 million mijoz ma'lumoti o'g'irlangan. ## Brute force skaner — asosiy versiya ```go package main import ( "fmt" "github.com/miekg/dns" ) // checkSubdomain — bitta subdomenni tekshiradi, mavjudligini qaytaradi func checkSubdomain(subdomain, domain, dnsServer string) bool { target := fmt.Sprintf("%s.%s", subdomain, domain) m := new(dns.Msg) m.SetQuestion(dns.Fqdn(target), dns.TypeA) m.RecursionDesired = true c := new(dns.Client) r, _, err := c.Exchange(m, dnsServer) // Xatolik yoki NXDOMAIN — subdomen yo'q if err != nil || r.Rcode != dns.RcodeSuccess { return false } return len(r.Answer) > 0 } func main() { domain := "example.com" dnsServer := "8.8.8.8:53" subdomains := []string{ "www", "mail", "dev", "test", "api", "admin", "blog", "staging", "vpn", "internal", } for _, sub := range subdomains { if checkSubdomain(sub, domain, dnsServer) { fmt.Printf("[+] topildi: %s.%s\n", sub, domain) } } } ``` Bu ishlaydi, lekin sekin — har bir so'rov ketma-ket yuboriladi. 10,000 so'z uchun soatlab vaqt ketishi mumkin. ## Wordlist fayldan o'qish Haqiqiy pentestingda SecLists kabi wordlist'lardan foydalanamiz: ```go import ( "bufio" "os" ) // loadWordlist — fayldan so'zlarni o'qiydi func loadWordlist(filename string) ([]string, error) { file, err := os.Open(filename) if err != nil { return nil, err } defer file.Close() var words []string scanner := bufio.NewScanner(file) for scanner.Scan() { line := strings.TrimSpace(scanner.Text()) if line != "" && !strings.HasPrefix(line, "#") { words = append(words, line) } } return words, scanner.Err() } ``` ## Parallel skaner — worker pool 10,000 subdomenni sekventsial tekshirish ~83 daqiqa (0.5s/so'rov). 50 ta goroutine bilan bu 1.6 daqiqaga tushadi. **Worker pool** naqshi — goroutine'lar kanal (channel) orqali ish oladi: ```go package main import ( "fmt" "sync" "github.com/miekg/dns" ) // worker — kanaldan subdomen olib, tekshirib, natijaga yuboradi func worker(domain, dnsServer string, jobs <-chan string, results chan<- string, wg *sync.WaitGroup) { defer wg.Done() c := new(dns.Client) for sub := range jobs { target := fmt.Sprintf("%s.%s", sub, domain) m := new(dns.Msg) m.SetQuestion(dns.Fqdn(target), dns.TypeA) r, _, err := c.Exchange(m, dnsServer) if err == nil && r.Rcode == dns.RcodeSuccess && len(r.Answer) > 0 { results <- target } } } func scanSubdomains(domain, dnsServer string, wordlist []string, workerCount int) []string { jobs := make(chan string, len(wordlist)) results := make(chan string, 100) var wg sync.WaitGroup // Ishchilarni ishga tushirish for i := 0; i < workerCount; i++ { wg.Add(1) go worker(domain, dnsServer, jobs, results, &wg) } // Ishlarni konveyerga joylash for _, sub := range wordlist { jobs <- sub } close(jobs) // Barcha ishchilar tugagach, results kanalini yopish go func() { wg.Wait() close(results) }() // Natijalarni yig'ish var found []string for res := range results { fmt.Printf("[+] %s\n", res) found = append(found, res) } return found } func main() { domain := "example.com" wordlist := []string{"www", "dev", "api", "mail", "admin", "blog", "test", "staging"} fmt.Printf("Qidiruv boshlandi: %s\n", domain) found := scanSubdomains(domain, "8.8.8.8:53", wordlist, 50) fmt.Printf("\nJami topildi: %d\n", len(found)) } ``` ## Wildcard detection Ba'zi domenlar `*.example.com` — barcha so'rovlarga javob qaytaradi. Bu holda brute force noto'g'ri natijalar beradi. Wildcard'ni aniqlash — mavjud bo'lmaydigan tasodifiy subdomeni so'raymiz: ```go import ( "math/rand" "strconv" ) // isWildcard — domen wildcard DNS ishlatadimi? func isWildcard(domain, dnsServer string) bool { // Mavjud bo'lmaydigan tasodifiy subdomen random := "xn--" + strconv.Itoa(rand.Int()) + "-nonexistent" target := random + "." + domain m := new(dns.Msg) m.SetQuestion(dns.Fqdn(target), dns.TypeA) c := new(dns.Client) r, _, err := c.Exchange(m, dnsServer) // Agar tasodifiy nom uchun ham javob kelsa — wildcard return err == nil && r.Rcode == dns.RcodeSuccess && len(r.Answer) > 0 } // Skaner boshida tekshirish func main() { domain := "example.com" if isWildcard(domain, "8.8.8.8:53") { fmt.Printf("OGOHLANTIRISH: %s wildcard DNS ishlatadi — natijalar ishonchsiz\n", domain) return } // Normal skanerlash... } ``` ## To'liq scanner ```go package main import ( "bufio" "flag" "fmt" "math/rand" "os" "strconv" "sync" "time" "github.com/miekg/dns" ) func main() { domain := flag.String("d", "", "Maqsad domen") wordlistFile := flag.String("w", "", "Wordlist fayli") workers := flag.Int("t", 50, "Parallel so'rovlar soni") dnsServer := flag.String("s", "8.8.8.8:53", "DNS server") flag.Parse() if *domain == "" || *wordlistFile == "" { fmt.Println("Ishlatish: scanner -d example.com -w wordlist.txt") os.Exit(1) } // Wildcard tekshiruv if isWildcard(*domain, *dnsServer) { fmt.Printf("OGOHLANTIRISH: %s wildcard ishlatadi\n", *domain) fmt.Println("Davom ettiriladimi? (ha/yo'q):") var ans string fmt.Scan(&ans) if ans != "ha" { os.Exit(0) } } words, err := loadWordlist(*wordlistFile) if err != nil { fmt.Printf("Fayl xatosi: %v\n", err) os.Exit(1) } fmt.Printf("Qidiruv: %s | %d so'z | %d parallel\n", *domain, len(words), *workers) start := time.Now() found := scanSubdomains(*domain, *dnsServer, words, *workers) fmt.Printf("\nTugadi: %v\n", time.Since(start)) fmt.Printf("Topildi: %d subdomen\n", len(found)) } func isWildcard(domain, dnsServer string) bool { random := "xn--" + strconv.Itoa(rand.Int()) + "-nx" m := new(dns.Msg) m.SetQuestion(dns.Fqdn(random+"."+domain), dns.TypeA) c := new(dns.Client) r, _, err := c.Exchange(m, dnsServer) return err == nil && r.Rcode == dns.RcodeSuccess && len(r.Answer) > 0 } func loadWordlist(filename string) ([]string, error) { file, err := os.Open(filename) if err != nil { return nil, err } defer file.Close() var words []string scanner := bufio.NewScanner(file) for scanner.Scan() { if w := scanner.Text(); w != "" { words = append(words, w) } } return words, scanner.Err() } func worker(domain, dnsServer string, jobs <-chan string, results chan<- string, wg *sync.WaitGroup) { defer wg.Done() c := &dns.Client{Timeout: 2 * time.Second} for sub := range jobs { target := sub + "." + domain m := new(dns.Msg) m.SetQuestion(dns.Fqdn(target), dns.TypeA) r, _, err := c.Exchange(m, dnsServer) if err == nil && r.Rcode == dns.RcodeSuccess && len(r.Answer) > 0 { results <- target } } } func scanSubdomains(domain, dnsServer string, wordlist []string, workerCount int) []string { jobs := make(chan string, len(wordlist)) results := make(chan string, 100) var wg sync.WaitGroup for i := 0; i < workerCount; i++ { wg.Add(1) go worker(domain, dnsServer, jobs, results, &wg) } for _, sub := range wordlist { jobs <- sub } close(jobs) go func() { wg.Wait() close(results) }() var found []string for res := range results { fmt.Printf("[+] %s\n", res) found = append(found, res) } return found } ``` Ishlatish: ```bash go build -o scanner . # Kichik wordlist bilan test ./scanner -d example.com -w common.txt # Katta wordlist, ko'p parallel ./scanner -d example.com -w subdomains-top1mil.txt -t 100 ``` > [!TIP] > SecLists'dan foydali wordlist'lar: `Discovery/DNS/subdomains-top1million.txt` — 1 million eng keng tarqalgan subdomeni o'z ichiga oladi. ## Qisqacha 1. Dev, staging, old kabi subdomenlar ko'pincha asosiy domen'dan zaifroq himoyalangan. 2. Brute force — wordlist'dagi har bir so'z uchun DNS so'rov yuboriladi. 3. Worker pool — `N` goroutine kanal orqali ish oladi, tezlikni `N` marta oshiradi. 4. Wildcard detection — skanerlashdan oldin amalga oshiriladi, aks holda natijalar noto'g'ri bo'ladi. 5. 2 soniyalik timeout — DNS timeout'siz goroutine'lar abadiy osilib qolishi mumkin. ## Keyingi qadam Keyingi darsda **DNS Reconnaissance** — tizimlashgan razvedka: barcha record turlarini bir vaqtda tekshirish, Zone Transfer (AXFR) hujumi va reverse DNS lookup.

Subdomain Enumeration (Pastki Domenlarni Aniqlash)