frogy

Using the combination of different subdomain enumeration tools and logic this script tries to identify more subdomains and TLDs in recon.

Logic

Frogy

  • Requirements: Go Language, Python 3.+, jq

  • Tools used - You must need to install these tools and place them into /usr/bin folder to use this script

    You might require to install WHOIS and JQ depending upon your enviroment. You can install them using the following commands:

     apt install jq
     apt install whois
    
  • Installation

    git clone https://github.com/iamthefrogy/frogy.git
    cd frogy
    chmod +x frogy.sh
    
  • Usage

    ./frogy.sh
    
  • Output

    Output will be saved within output/ORG/ORG.master file. 
    If telsa.com is your target then output file Of all the subdomains will be output/telsa/tesla.master and all the TLDs will be recorded in the output/tesla/tld.txtls file.
    

TODO

  • Efficient folder structure management
  • Resolving subdomains using Massdns
  • Add dnscan for extened subdomain enum scope
  • Add scope for extened subdomain enum scope
  • Eliminate false positives. Currently around 2% to 4% false positives are there.
  • Removed resolving part
  • Find live URLs on standard (80, 443) and non-standard ports (8080, 8443, 8888, etc.)
  • Search for assets in CHAOS for organization names having space.
  • Add dnsenum for more extended support.
  • To run it on a weekly basis, I will add more checks to report 4 things - 1. Total unique subdomains 2. Total unqiue TLDs 3. Total new unique subdomains found on the date you run, 4. Total new unique TLDs found on the date you run. With these output, you can focus more on newly found domains and subdomains on a weekly or daily basis based on your cronjob.

GitHub

https://github.com/iamthefrogy/frogy