A little python script for evaluating subdomains!

So today we have a little python script i wrote that helps you evaluate subdomains for a given domain. We will look at the script step by step to help you understand.

The script can be found here:

https://github.com/toslaty/steem/blob/master/eval.py

The finished script will be invoked via the following command:

python eval.py -i Datei.txt -w domain.txt -d google.com

• i is the wordlist that shall be read
• w is the output list to which the script will write the found subdomains to
• d is where you enter the targeted domain (for example google.com)

So let's look at the script. First we have to import the following libraries via import(): requests and argparse

So what are these libraries for? Requests is a easy to use library for making http requests.
Argparse is the library responsible for creating our command line interface.

As in most cases, the main()-function is the entry point for our script. Here we first define the ArgumentParser() object (line 29) which is necessary if we want our command line arguments to be recognized.
After that we add the arguments with the add_argument() method. Here we can define things like the expected data type(by default it is read as a string) or the help to the command that shall be invoked.

Now we invoke parse_args() for our parser object from line 29. It is possible to define an action for the arguments and what is to be done with them. The default action here is store so we‘ll go with it because that is enough for our purpose.
In line 36 we check if any of the options was left empty at program start. In case of being empty the program will print out its usage.

So now we are actually going to work with the specified arguments. Remember? Our goal was to take input from a given textfile and check if there is subdomain for a given domain and print that out to a new file.

We achieve this by opening the openfi() function which is defined in lines 5 to 12. This fuction takes in the given command line arguments. First we open the file which is supplied in the command line options via -i with open() in line 6. „r“ specifies that the file will be read.
Now we have a little loop that iterates through any line in our file f. After that we call the req() function.
We do this with a try except construction because if a connection cant be made an exception will be thrown. Except: continue will tell the script to ignore the exception.

So in the req() function we make the actual request. We define a variable that holds the string with the address to connect to. After that we make the request and check if the status code is 200.

If it is, the address will be written to the .txt-file you specified when the script started. For that we define the writeto() function.

Here is the wordlist with the input we used when starting the script.

And here is the output in the wordlist we produced which told us that mail.google.com is a valid subdomain.

If you have any questions feel free to post them below.