[+] Subdomain Scan 2014

/***
     ▄▄▄▄▄▄▄▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄     ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄
    ▐░░░░░░░░░░▌ ▐░░░░░░░░░░░▌   ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
    ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌   ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌
    ▐░▌       ▐░▌▐░▌       ▐░▌   ▐░▌          ▐░▌       ▐░▌▐░▌       ▐░▌▐░▌          ▐░▌       ▐░▌▐░▌       ▐░▌
    ▐░▌       ▐░▌▐░█▄▄▄▄▄▄▄█░▌   ▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄█░▌
    ▐░▌       ▐░▌▐░░░░░░░░░░░▌   ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
    ▐░▌       ▐░▌▐░█▀▀▀▀█░█▀▀    ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀█░█▀▀ ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀█░█▀▀
    ▐░▌       ▐░▌▐░▌     ▐░▌     ▐░▌          ▐░▌       ▐░▌▐░▌     ▐░▌  ▐░▌          ▐░▌       ▐░▌▐░▌     ▐░▌
    ▐░█▄▄▄▄▄▄▄█░▌▐░▌      ▐░▌  ▄ ▐░▌          ▐░▌       ▐░▌▐░▌      ▐░▌ ▐░▌          ▐░▌       ▐░▌▐░▌      ▐░▌
    ▐░░░░░░░░░░▌ ▐░▌       ▐░▌▐░▌▐░▌          ▐░▌       ▐░▌▐░▌       ▐░▌▐░▌          ▐░▌       ▐░▌▐░▌       ▐░▌
     ▀▀▀▀▀▀▀▀▀▀   ▀         ▀  ▀  ▀            ▀         ▀  ▀         ▀  ▀            ▀         ▀  ▀         ▀



~~~ :xD: Have Fun. Don't Forget To Bookmark This Website :xD:
~~~ https://www.FaceBook.com/Dr.FarFar
~~~ http://Dr-FarFar.BlogSpot.com/

*/

###################################################################################################

<?php
echo "Welcome to bezel subdomain scan...\n";
class sc {

    private $googleRequests = 15;

    public function __construct($domain){
        $arrSubs = array();
        echo "Starting to scan...\nProcess: ";
        for($i=0;$i<$this->googleRequests;$i++) {
            $qry=$this->buildQuery($domain,$arrSubs);
            $tmpSubs=$this->getSubs($domain,$qry);
            if(is_array($tmpSubs) && !empty($tmpSubs)) {
                foreach($tmpSubs as $sub) {
                    if(!in_array($sub,$arrSubs) && $sub != "") {
                            $arrSubs[]=$sub;
                    }
                }
            }

        }
        echo "\n";
        if(count($arrSubs)) {
            //safe the log
            file_put_contents("sclog_".$domain.".txt","Subdomain scan log of domain ".$domain."\n\n");
            foreach($arrSubs as $result ) {
                    echo $result . $domain . "\n";
                    file_put_contents("sclog_".$domain.".txt","-".$result.$domain."\n",FILE_APPEND);
            }
            echo "Job done...have fun pwnin...\n";
        } else {
            echo "No subs found for ".$domain."...goin down for maintenance\n";
        }
    }


    private function getSubs($domain,$qry) {
        echo " *";
        $urls = array();
        $qry = urlencode($qry);
        $ch = curl_init("http://www.google.co.uk/search?q=".$qry."&num=100");
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1');
        $output = curl_exec($ch);
        curl_close($ch);
        preg_match_all('|<h3 class="r">(.*?)</h3>|',$output,$matches);
        foreach($matches[0] as $match) {
            $match = explode('href="',$match);
            $match = explode('"',$match[1]);
            $match = $match[0];
            if(substr($match,0,7) != "/search" && substr($match,0,7) != "/images") {
                $match = substr($match,7);
                $match = explode('&',$match,2);
                $match = $match[0];
                $urls[]=$match;
            }
        }
        $return = array();
        foreach($urls as $url) {
                $tmp=explode($domain,$url);
                $return[]=str_replace("ftp://","",str_replace("http://","",str_replace("https://","",str_replace("www.","",$tmp[0]))));
        }
        return $return;
    }


    private function buildQuery($domain,$arrSubs) {
        $tmp = "site:".$domain." -site:www.".$domain;
        foreach($arrSubs as $sub) {
                $tmp.= " -site:".$sub.".".$domain;
        }
        return $tmp . ' inurl:"https://"';
    }


}
if(isset($argv[1])) {
    $s=new sc($argv[1]);
} else {
    echo "Bzzp....missing param...shutting down ...(._.)... \n";
}
?>

########################################################################################################################

        https://www.facebook.com/Dr.FarFar
        http://Dr-FarFar.BlogSpot.com/

        ________         __________                __________
        ___  __ \___________  ____/______ ____________  ____/______ _________
        __  / / /__  ___/__  /_    _  __ `/__  ___/__  /_    _  __ `/__  ___/
        _  /_/ / _  /___ _  __/    / /_/ / _  /    _  __/    / /_/ / _  /
        /_____/  /_/ _(_)/_/       \__,_/  /_/     /_/       \__,_/  /_/

                             ~\ Dr.FarFar /~