Subrake, initially started as a personal project of mine for subdomain enumeration is a now a detailed DNS scanning tool that can help you identify Zone Transfers, DNS Zone Takeover and Subdomain Takeovers all in a single go.
Zone Transfers have been there for years now and if enabled for some reason on a domain can allow another party to enumerate all the records from the Zone. They are actually used when the owner is to tranfer domain from one provider to another.
Subdomain Takeover unlike it sounds is the takeover of the service that the subdomain is pointing to. The service needs to be stale or not in use.
DNS Zone Takeover as compared to Subdomain Takeover can be more severe if exploited. It is the takeover of one of the zones of the domain. This allows much more than just creating the service on the backend. You can actually setup your own DNS records and play with them as you line
For more in-depth detail, you can read my blog here: A Guide to Zone Transfer, DNS Zone Takeover and Subdomain Takeover
Subrake is DNS Assessment tool (mostly automated) with both a UI and CLI goes trough various phases in order to cover DNS issues. The tool is continuously undergoing changes and development and everybody is welcome to contribute to the project.
It was designed primarily for bug bounty and infosec industry but can be leveraged for blue teaming and internal pentests as well. It supports both a CLI and Web Based GUI Interface and supports multiple installation modes. The key features are:
- ⚙️ All in one automated solution. Its working cycle is:
- 🪙 DNS Enumeration (DNS Records)
- 🪜 Zone Transfer Detection and enumerate records if enabled
- 💲 DNS Zone Takeover Detection
- 💴 False Positive Detection (Wildcard subdomains)
- 💶 Getting results from other tools (Sublist3r, Knock.py)
- 💷 Bruteforce using wordlists (Can work with multiple wordlists)
- 💵 Get 5 parameters for each subdomain (HTTP Codes, Resolution, Headers, CNAME, Ports)
- 💰 Detect Subdomain Takeover
- 🛒 Support for external tools. You can add your own functions.
- 🛍️ Automated and Manual Mode.
- 🗄️ Can run concurrent sessions.
- 🖼️ UI for Reports and results available in
csvformat. - 🛎️ Flexible and Fast.
subrake.webm
You can setup subrake by an automated mode or by manually cloning the repo and install through setuptools. The first provides more control and is flexible with a UI. But if you prefer a simple CLI mode or on windows, go through the manual section.
Clone the repo and jump into it:
$ git clone https://github.com/hash3liZer/Subrake.git
$ cd ./SubrakeYou can setup subrake through vagrant (with KVM) where a machine will be spawned and everything will be automatically setup. Install the requirements first:
$ apt update
$ apt install -y qemu qemu-kvm libvirt-daemon libvirt-clients bridge-utils virt-manager vagrant vagrant-libvirtThen inside the repo, run vagrant up:
$ vagrant upThis will take a while to provision the server. After done, you will receive the URL: http://127.0.0.1:9090
The default credentials are: subrake/password. You can change them during provisioning as well:
$ SUBRAKE_USERNAME="username" SUBRAKE_PASSWORD="password" vagrant upAfter done, you can manage the state of your newly created machine through these commands:
# See the machine status
$ vagrant status
# Suspend the machine
$ vagrant suspend
# Resume machine
$ vagrant resume
# Shutdown machine
$ vagrant halt
# Start back
$ vagrant up
# Delete the machine
$ vagrant destroyWith the manual setup, you can directly jump into directory and the setuptools for installation
Install the requirements and run setup.py:
$ pip3 install -r requirements.txt
$ python3 setup.py installVerify if subrake is installed or not:
subrake --helpYou can also build the docker image from Dockerfile:
$ docker build -t subrake:latest .Verify the docker container:
$ docker run --rm subrake --helpYou can deploy the script on a baremetal server as well. To do so, get a fresh ubuntu 20.04 server up and running and run the following command:
$ chmod +x ./installer.sh
$ ./installer.sh --deployThe server is then accessible at: 0.0.0.0:9090. You can setup an nginx service and use it s a reverse proxy.
With the UI, you can directly jump to the Subtap a Domain page and run a scan. Expect a couple questions for the scan:
The scan is launched inside a tmux session. You can press CTRL+E => d to exit the running screen and launch a new scan. Also, to pause the screen and move up and down, you can press CTRL+E => [. Its just TMUX shortcuts with the global bind key changed to CTRL+E.
You can also jump back to a running screen by entering its name again:
On command line, you an directly access the tool by typing subrake. Here are a couple example of using subrake:
A simple run with default options:
$ subrake -d google.comSubrake with Multiple Threads:
$ subtake -d google.com -t 50Subrake with modules and a wordlist:
$ subrake -d google.com --wordlists SecLists/Discovery/DNS/namelist.txtSubrake with OSINT results + Multiple SecLists subdomains list:
Note: Subdomains with similar names will automatically be filtered and counted as 1
$ subrake -d google.com --wordlists SecLists/Discovery/DNS/namelist.txt,SecLists/Discovery/DNS/dns-Jhaddix.txtSubrake without search engine + Output from multiple tools combined + IP Filtering (Note that you can integrate your tools into subrake):
$ domain="google.com"
$ subfinder -d $domain -nW -o $domain/1.txt && sublist3r -d $domain -o $domain/2.txt && cat $domain/* >> /tmp/output.txt
$ subrake -d $domain -w tmp/output.txt --filter --skip-searchSubrake with Port Scanning:
NOTE: The port 80,443 will be scanned by default for every host under HTTP/HTTPS banner. So, there's no need to specify them here
$ subrake -d google.com --ports 8080,8443,8000,23,445
Feel free to open pull requests and a feature. You can contribute by:
- Add more vulnerable services. Currently 10
- Improve Insatllation script.
- Add GUI Mode
- Add Docker support.
- Email: me@shameerkashif.me
- Discord: hash3liZer#5786
- Blog: https://blog.shameerkashif.me