bash scan domain

#!/bin/bash

# "***********************************************************************"

# "*    In The Name Of ALLAH                                             *"

# "*    IrIsT Sub Domain Scanner                                         *"

# "*    www.IrIsT.Ir                                                     *"

# "*    Coded By : Beni_Vanda                                            *"

# "*    Gr33tz : Am!r ,C0dex ,B3HZ4D ,TaK.FaNaR ,0x0ptim0us ,MR.F@RDIN   *"

# "*    skote_vahshat ,M.R.S.CO ,Net.W0lf , IR Anonymous, joker_s        *"

# "*    && All Turkish/Iranian/Kurdish Hackerz                           *"

# "*    [email protected]                                             *"

# "***********************************************************************"



#Used This servers

#http://www.bing.com

#http://www.google.com/



F_ARG=$1

page=0

last_page_check=

how_many=1

single_page=

domain=



function Usage()

{

echo ""

echo "# ********************************************************************************​​**********#"

echo "# Usage      : IrIsT-SubDomain-Scanner.sh [Domain]                                         *#"

echo "# Help       : -h && --help : Show This Menu                                               *#"

echo "# RunScript  : give permision to script and run it  ./IrIsT-SubDomain-Scanner.sh <Domain>   #"

echo "# ********************************************************************************​​**********#"

echo ""

}



# check for arguments

if [ -z "$F_ARG" ] || [ "$F_ARG" == "-h" ] || [ "$F_ARG" == "--help" ]; then

Usage;

exit 1

fi



if [ `echo "$F_ARG" | egrep  "http://"` ] || [ `echo "$F_ARG" | egrep  "Http://"` ];

then

echo -e "\e[1;31mplease insert doamin with out http:// \e[0m"

exit 1

fi



if [ `echo "$F_ARG" | egrep  "www."`  ];

then

domain=`echo "$F_ARG" |sed '/www./s///g' `

else

domain=$F_ARG

fi





echo -e "\e[1;31m[*] Going To Use Bing Servers ...\e[0m"





while [ -z "$last_page_check" ] && [ -n "$how_many" ] && [ -z "$single_page" ]; do



#http://www.bing.com/search?q=%27yahoo.com%27&qs=n&pq=%27yahoo.com%27&sc=0-0&sp=-1&sk=&first=80&FORM=PERE"



url="http://www.bing.com/search?q=%27$domain%27&qs=n&pq=%27$domain%27&sc=0-0&sp=-1&sk=&first=${page}0&FORM=PERE"

# url="http://www.bing.com/search?q=ip%3A$IP&go=&qs=n&first=${page}0&FORM=PERE"



# out=`mktemp -p /tmp -t IrIsT_Sub_Domain_Bing.tmp.XXXXXX`

wget -q -O sub_domain_bing.php "$url"



last_page_check=`egrep -o '<span class="sb_count" id="count">[0-9]+-([0-9]+) of (\1)' sub_domain_bing.php`



# if no results are found, how_many is empty and the loop will exit

how_many=`egrep -o '<span class="sb_count" id="count">[^<]+'
sub_domain_bing.php | cut -d '>' -f 2|cut -d ' ' -f 1-3`



#  check for a single page of results

single_page=`egrep -o '<span class="sb_count" id="count">[0-9] results' sub_domain_bing.php `





cat "sub_domain_bing.php" | egrep -o "<h3><a href=\"[^\"]+"
sub_domain_bing.php | cut -d '"' -f 2 >> alldomain_bing.txt

rm -f sub_domain_bing.php

let page=$page+1

done



cat alldomain_bing.txt | cut -d '/' -f 3 | tr '[:upper:]' '[:lower:]' | sed '/www./s///g' | sort | uniq >> subdomain.txt



number=0



for line in `cat subdomain.txt`

do

  varfor=`echo "$line" | egrep  "$domain"`

   let number=$number+1

   if [ -z $varfor ]

    then

       echo "$number" >> many.txt

    fi

done





count=0

for txtvar in `cat many.txt`

do

       let del=$txtvar-$count

       hey=$del

       sed -i "$hey"d subdomain.txt

       let count=$count+1

done





#sort subdomain | uniq

found_N=`wc -l subdomain.txt | sed 's/subdomain.txt//'`

echo -e "\e[1;34mFound $found_N SubDomain :) \e[0m"





for catvar in `cat subdomain.txt`

do

echo -e "\e[1;32m$catvar \e[0m"

done



rm -f alldomain_bing.txt;

rm -f many.txt;