- Notifications
You must be signed in to change notification settings - Fork195
HostHunter a recon tool for discovering hostnames using OSINT techniques.
License
NotificationsYou must be signed in to change notification settings
SpiderLabs/HostHunter
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
A tool to efficiently discover and extract hostnames providing a large set of target IPv4 or IPv6 addresses. HostHunter utilises simple OSINT and active reconaissance techniques to map IP targets with virtual hostnames. This is especially useful for discovering the true attack surface of your organisation. Output can be generated in multiple formats including CSV, TXT or Nessus file formats.
Click on the thumbnail above to view the demo.
- Tested with Python 3.10.8.
- Install Python dependencies.
$ python3.10 -m pip install -r requirements.txt
$ python3.10 hosthunter.py<targets.txt>
$ cat vhosts.csv
HostHunter Help Page
$ python3.10 ./hosthunter.py -husage: hosthunter.py [-h] [-f FORMAT] [-o OUTPUT] [-t TARGET] [-g GRAB] [-v] [-V] [-d] [targets][?] HostHunter v2.0 - Help Pagepositional arguments: targets Sets the path of the target IPs file.options: -h, --help show thishelp message andexit -f FORMAT, --format FORMAT Choose between .CSV and .TXT output file formats. -o OUTPUT, --output OUTPUT Sets the path of the output file. -t TARGET, --target TARGET Hunt a Single IP. -g GRAB, --grab GRAB Choose which SSL ports to actively scan. Default ports: 21/tcp, 25/tcp, 443/tcp, 993/tcp, 8443/tcp -v, --verify Attempts to resolve IP Address -V, --version Displays the current version. -d, --debug Displays additional output and debugging information.Author: Andreas Georgiou (@superhedgy)
Run HostHunter Screen Capture module and output a Nessus file:
$ python3.10 hosthunter.py<targets.txt> --nessus -o hosts.csv
Display Results
$ cat hosts.csv
View Screenshots
$ open ./screen_captures/
- Works with Python3.10
- Extracts information from SSL/TLS certificates.
- Supports Free HackerTarget API requests.
- Takes Screenshots of the target applications.
- Validates the targets IPv4 address.
- Supports .txt and .csv output file formats
- Gathers information from HTTP headers.
- Verifies Internet access.
- Retrieves hostname values from services at 21/tcp, 25/tcp, 80/tcp and 443/tcp ports.
- Supports Nessus target format output.
- Improve output (IPs, HostNames, FQDNs)
- Actively pull SSL certificates from other TCP ports
- Select with SSL ports to target
- Verify discovered hostnames against target IPs
- Support for IPv6
- Pause and Resume Execution
- Support for a Premium HackerTarget API key
- Gather information from additional APIs
- Free APIs throttle the amount of requests per day per source IP address.
This project is licensed under the MIT License.
- Andreas Georgiou - follow me on twitter -@superhedgy
Feel free to create a Pull Request if you have any ideas or features you would like to add. Otherwise reach me out on twitter @superhedgy.
About
HostHunter a recon tool for discovering hostnames using OSINT techniques.
Topics
Resources
License
Uh oh!
There was an error while loading.Please reload this page.
Stars
Watchers
Forks
Packages0
No packages published
Uh oh!
There was an error while loading.Please reload this page.

