|
1 | | -# Knock Subdomain Scan v7 |
| 1 | +# 🔍 Knock Subdomain Scan v8 |
2 | 2 |
|
3 | | -:heavy_check_mark: Fast :heavy_check_mark: Easy :heavy_check_mark: Modular |
| 3 | +✅ Fast & Async • 🔐 Recon + Brute • 🔧 Easy to Extend |
4 | 4 |
|
5 | | -**Knockpy** is a portable and modular `python3` tool designed to quickly enumerate subdomains on a target domain through *passive reconnaissance* and *dictionary scan*. |
| 5 | +**KnockPy** is a modular Python 3 tool to enumerate subdomains via passive reconnaissance and bruteforce, now with **async/await support**, enhanced performance, and modern HTTP/TLS handling. |
6 | 6 |
|
7 | | - |
| 7 | +> Version: **8** |
| 8 | +> GitHub: [https://github.com/guelfoweb/knock](https://github.com/guelfoweb/knock) |
8 | 9 |
|
9 | | -## Install via pip |
| 10 | + |
10 | 11 |
|
11 | | -``` |
12 | | -pip install knock-subdomains |
13 | | -``` |
| 12 | +--- |
| 13 | + |
| 14 | +## 🚀 Features (v8) |
| 15 | + |
| 16 | +- ✅ **Async scanning** with `httpx` and DNS resolution |
| 17 | +- ✅ Modular: plug new passive sources easily |
| 18 | +- 🔍 Supports **passive recon**, **bruteforce**, or both |
| 19 | +- 📜 Validates **HTTP/HTTPS status**, **TLS cert**, and **IP** |
| 20 | +- 💡 Supports **wildcard DNS** detection |
| 21 | +- 🧪 Output as **JSON**, optional save & reload |
| 22 | +- 🔐 Supports **VirusTotal** and **Shodan** API |
| 23 | + |
| 24 | +--- |
| 25 | + |
| 26 | +## 📦 Installation |
14 | 27 |
|
15 | | -## Install via git |
| 28 | +### From GitHub source (recommended) |
16 | 29 |
|
17 | 30 | ```bash |
18 | 31 | git clone https://github.com/guelfoweb/knock.git |
19 | 32 | cd knock |
20 | 33 | pip install . |
21 | 34 | ``` |
22 | 35 |
|
23 | | -## Usage |
| 36 | +⚠️ Recommended Python version: 3.9+ |
24 | 37 |
|
25 | | -``` |
26 | | -usage: KNOCKPY [-h] [-d DOMAIN] [-f FILE] [-v] [--dns DNS] [--useragent USERAGENT] |
27 | | - [--timeout TIMEOUT] [--threads THREADS] [--recon] [--bruteforce] |
28 | | - [--wordlist WORDLIST] [--json-output] [--list] [--report REPORT] |
29 | | -
|
30 | | -knockpy v.7.0.1 - Subdomain Scan |
31 | | -https://github.com/guelfoweb/knock |
32 | | -
|
33 | | -options: |
34 | | - -h, --help show this help message and exit |
35 | | - -d DOMAIN, --domain DOMAIN |
36 | | - domain to analyze |
37 | | - -f FILE, --file FILE domain list from file path |
38 | | - -v, --version show program's version number and exit |
39 | | - --dns DNS custom dns |
40 | | - --useragent USERAGENT |
41 | | - custom useragent |
42 | | - --timeout TIMEOUT custom timeout |
43 | | - --threads THREADS custom threads |
44 | | - --recon subdomain reconnaissance |
45 | | - --bruteforce subdomain bruteforce |
46 | | - --wordlist WORDLIST wordlist file to import |
47 | | - --bruteforce option required |
48 | | - --wildcard test wildcard and exit |
49 | | - --json shows output in json format |
50 | | - --save FOLDER folder to save report |
51 | | - --report REPORT shows saved report |
| 38 | + |
| 39 | +### Using pip |
| 40 | + |
| 41 | +*Only after the stable version is released on GitHub* |
| 42 | + |
| 43 | +```bash |
| 44 | +pip install knock-subdomains |
52 | 45 | ``` |
53 | 46 |
|
54 | | -### Example |
| 47 | +## 🧪 Usage |
55 | 48 |
|
56 | | -- Start scanning domain with `--recon` and `--bruteforce` options |
| 49 | +```bash |
| 50 | +knockpy -d domain.com [options] |
| 51 | +``` |
| 52 | + |
| 53 | +### Options |
| 54 | + |
| 55 | +| Flag | Description | |
| 56 | +| ----------------- | ---------------------------------- | |
| 57 | +| `-d`, `--domain` | Target domain | |
| 58 | +| `-f`, `--file` | File with list of domains | |
| 59 | +| `--recon` | Enable passive reconnaissance | |
| 60 | +| `--bruteforce`,`brute` | Enable bruteforce using wordlist | |
| 61 | +| `--wordlist` | Custom wordlist (default included) | |
| 62 | +| `--dns` | Custom DNS resolver | |
| 63 | +| `--useragent` | Custom HTTP user-agent | |
| 64 | +| `--timeout` | Request timeout in seconds | |
| 65 | +| `--threads` | Number of concurrent workers | |
| 66 | +| `--wildcard` | Test wildcard DNS and exit | |
| 67 | +| `--json` | Output results in JSON | |
| 68 | +| `--save FOLDER` | Save report to folder | |
| 69 | +| `--report FILE` | Load and show a saved report | |
| 70 | +| `--silent` | Hide progress bar | |
| 71 | +| `--logfile` | Write debug log to file | |
| 72 | +| `--show-settings` | Print scan settings and continue | |
| 73 | +| `--version` | Show KnockPy version | |
| 74 | +| `-h`, `--help` | Show help message | |
| 75 | + |
| 76 | + |
| 77 | +## 📌 Examples |
| 78 | + |
| 79 | +### 🔎 Recon + Brute |
57 | 80 |
|
58 | 81 | ```bash |
59 | | -knockpy -d domain.com --recon --bruteforce |
| 82 | +knockpy -d example.com --recon --bruteforce |
60 | 83 | ``` |
61 | 84 |
|
62 | | -- Set API KEY: VirusTotal and Shodan |
| 85 | +### 🧠 API Keys (optional) |
63 | 86 |
|
64 | 87 | ```bash |
65 | 88 | export API_KEY_VIRUSTOTAL=your-virustotal-api-key |
66 | 89 | export API_KEY_SHODAN=your-shodan-api-key |
67 | 90 | ``` |
68 | 91 |
|
69 | | -- Save the report in a folder |
| 92 | +You can use `.env` file: |
70 | 93 |
|
71 | 94 | ```bash |
72 | | -knockpy -d domain.com --recon --bruteforce --save report |
| 95 | +API_KEY_VIRUSTOTAL=your-virustotal-api-key |
| 96 | +API_KEY_SHODAN=your-shodan-api-key |
73 | 97 | ``` |
74 | 98 |
|
75 | | -- Shows saved report |
| 99 | +### 💾 Save and reload report |
76 | 100 |
|
77 | 101 | ```bash |
78 | | -knockpy --report domain.com_yyyy_aa_dd_hh_mm_ss.json |
| 102 | +knockpy -d example.com --recon --bruteforce --save report/ |
| 103 | +knockpy --report report/example.com_2025_10_25_14_00_00.json |
79 | 104 | ``` |
80 | 105 |
|
81 | | -### Import as module |
| 106 | +### 🧪 Wildcard test only |
| 107 | + |
| 108 | +```bash |
| 109 | +knockpy -d example.com --wildcard |
| 110 | +``` |
| 111 | + |
| 112 | +## 🧬 Python API Usage |
| 113 | + |
| 114 | +KnockPy can be used as a Python module: |
82 | 115 |
|
83 | 116 | ```python |
84 | 117 | from knock import KNOCKPY |
85 | 118 |
|
86 | | -domain = 'domain.com' |
| 119 | +domain = 'example.com' |
| 120 | + |
| 121 | +results = KNOCKPY( |
| 122 | + domain, |
| 123 | + dns="8.8.8.8", |
| 124 | + useragent="Mozilla/5.0", |
| 125 | + timeout=2, |
| 126 | + threads=10, |
| 127 | + recon=True, |
| 128 | + bruteforce=True, |
| 129 | + wordlist=None, |
| 130 | + silent=False |
| 131 | +) |
| 132 | + |
| 133 | +for entry in results: |
| 134 | + print(entry['domain'], entry['ip'], entry['http'], entry['cert']) |
| 135 | +``` |
| 136 | + |
| 137 | +## 📂 Wordlist |
| 138 | + |
| 139 | +A default wordlist is included in `knock/wordlist/wordlist.txt`. |
| 140 | +You can supply your own with `--wordlist`. |
87 | 141 |
|
88 | | -results = KNOCKPY(domain, dns=None, useragent=None, timeout=None, threads=None, recon=True, bruteforce=True, wordlist=None) |
| 142 | +## Test |
89 | 143 |
|
90 | | -print (results) |
| 144 | +```bash |
| 145 | +python tests/poc.py |
91 | 146 | ``` |
| 147 | + |
| 148 | +## 📖 License |
| 149 | + |
| 150 | +Licensed under the GPLv3 license. |
| 151 | +Gianni Amato (@guelfoweb) |
0 commit comments