korelor / hosthunter

HostHunter a recon tool for discovering hostnames using OSINT techniques.

HostHunter v2.0

A tool to efficiently discover and extract hostnames providing a large set of target IPv4 or IPv6 addresses. HostHunter utilises simple OSINT and active reconaissance techniques to map IP targets with virtual hostnames. This is especially useful for discovering the true attack surface of your organisation. Output can be generated in multiple formats including CSV, TXT or Nessus file formats.

Demo

Click on the thumbnail above to view the demo.

Installation

• Tested with Python 3.10.8.

Linux / Mac OS

• Install Python dependencies.

$ python3.10 -m pip install -r requirements.txt

Simple Usage Example

$ python3.10 hosthunter.py <targets.txt>

$ cat vhosts.csv

More Examples

HostHunter Help Page

$ python3.10 ./hosthunter.py -h
usage: hosthunter.py [-h] [-f FORMAT] [-o OUTPUT] [-t TARGET] [-g GRAB] [-v] [-V] [-d] [targets]

[?] HostHunter v2.0 - Help Page

positional arguments:
  targets               Sets the path of the target IPs file.

options:
  -h, --help            show this help message and exit
  -f FORMAT, --format FORMAT
                        Choose between .CSV and .TXT output file formats.
  -o OUTPUT, --output OUTPUT
                        Sets the path of the output file.
  -t TARGET, --target TARGET
                        Hunt a Single IP.
  -g GRAB, --grab GRAB  Choose which SSL ports to actively scan. Default ports: 21/tcp, 25/tcp, 443/tcp, 993/tcp, 8443/tcp
  -v, --verify          Attempts to resolve IP Address
  -V, --version         Displays the current version.
  -d, --debug           Displays additional output and debugging information.

Author: Andreas Georgiou (@superhedgy)

Run HostHunter Screen Capture module and output a Nessus file:

$ python3.10 hosthunter.py <targets.txt> --nessus -o hosts.csv

Display Results

$ cat hosts.csv

View Screenshots

$ open ./screen_captures/

Features

• Works with Python3.10
• Extracts information from SSL/TLS certificates.
• Supports Free HackerTarget API requests.
• Takes Screenshots of the target applications.
• Validates the targets IPv4 address.
• Supports .txt and .csv output file formats
• Gathers information from HTTP headers.
• Verifies Internet access.
• Retrieves hostname values from services at 21/tcp, 25/tcp, 80/tcp and 443/tcp ports.
• Supports Nessus target format output.
• Improve output (IPs, HostNames, FQDNs)
• Actively pull SSL certificates from other TCP ports
• Select with SSL ports to target
• Verify discovered hostnames against target IPs
• Support for IPv6

Coming Next

• Pause and Resume Execution
• Support for a Premium HackerTarget API key
• Gather information from additional APIs

Notes

• Free APIs throttle the amount of requests per day per source IP address.

License

This project is licensed under the MIT License.

Authors

• Andreas Georgiou - follow me on twitter - @superhedgy

Contribute

Feel free to create a Pull Request if you have any ideas or features you would like to add. Otherwise reach me out on twitter @superhedgy.

StarGazers

Thank you for all the support & feedback!