SubDomain Scanner v1.0

<?php

        /*
                Bing SubDomain Scanner By injector_ma
        */
error_reporting(0);
set_time_limit(0);

if (!function_exists ("curl_exec"))
        die ("Fatal Error : cURL Extension is not Installed...\n");

$domain = $argv[1];

echo"
 _________    ___.        .___                    .__
/   _____/__ _\_ |__    __| _/____   _____ _____  |__| ____   ______
\_____  \|  |  \ __ \  / __ |/  _ \ /     \\__  \ |  |/    \ /  ___/
/        \  |  / \_\ \/ /_/ (  <_> )  Y Y  \/ __ \|  |   |  \\___ \
/_______  /____/|___  /\____ |\____/|__|_|  (____  /__|___|  /____  >
       \/          \/      \/            \/     \/        \/     \/
\n";

if(count(Bingsub ($domain)) == 0){

$subs = array(
"app","apps","cpanel","ftp","mail","mysql","webmail","smtp","pop","pop3","direct-connect",
"direct-connect-mail","record","ssl","dns","help","blog","forum","doc","home","shop",
"vb","www","web","webadmin","weblog","webmail","webmaster","webservices","webserver",
"log","logs","images","lab","ftpd","docs","download","downloads","about","backup",
"chat","data","smtp","upload","uploads","ns1","ns2","record","ssl","imap","result",
"vip","demo","beta","video"
);

        echo"\n\t\tNothing Found. Start Using Brute Force Methode ...\n\n";

        foreach($subs as $sub){

                $Check = @fsockopen("$sub.$domain", 80);
                if($Check){
                        echo  "$sub.$domain : ".gethostbyname("$sub.$domain")." \n\n";
                        $save = fopen('subdomains.txt','ab');
                        fwrite($save,"http://$sub.$domain\r\n");
                        fclose($save);
                }
        }
}else{

        foreach(Bingsub ($domain) as $sub){

                echo $sub." : ";
                        echo gethostbyname($sub)."\r\n";

                $save = fopen('subdomains.txt','ab');
                fwrite($save,"http://".$sub."\r\n");
                fclose($save);
        }
}

function Bingsub ($domain)
{

for($i = 1; $i <= 1000; $i += 10){
        $gt = curlreq("http://www.bing.com/search?q=".urlencode("domain:$domain")."&first=$i","msnbot/1.0 (+http://search.msn.com/msnbot.htm)");
        $searchme = '#<h2><a href="(.*?)"#i';
        if (preg_match_all ($searchme, $gt, $matches)){
                foreach ($matches[1] as $matches){
                        $urls[] = cleanme ($matches);
                }
        }
        if(!preg_match('#class="sb_pagN"#',$gt)) break;
}
if(!empty($urls) && is_array($urls)){
        return array_unique($urls);
    }
}

function cleanme ($link){
    return str_replace("www.","",parse_url($link, PHP_URL_HOST));
}

function curlreq($url, $user_agent, $proxy = FALSE, $post = FALSE)
{
        $ch = @curl_init($url);
        @curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
        @curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
        @curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
        if ($proxy)
        {
                @curl_setopt ($ch, CURLOPT_PROXY, $proxy);
        }
        if ($post)
        {
                @curl_setopt ($ch, CURLOPT_POST, TRUE);
                @curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
        }
        @curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);
        @curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
        $source = @curl_exec($ch);

    @curl_close($ch);
    return $source;
}