Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

I hope fofa api will be added in the future #1363

Open
smithdavida opened this issue May 8, 2024 · 3 comments
Open

I hope fofa api will be added in the future #1363

smithdavida opened this issue May 8, 2024 · 3 comments
Labels
module todo Idea for new module or improvement to an existing one

Comments

@smithdavida
Copy link

This is a masterpiece! I hope fofa api can be added in the future

@smithdavida smithdavida added the enhancement New feature or request label May 8, 2024
@TheTechromancer TheTechromancer added module todo Idea for new module or improvement to an existing one and removed enhancement New feature or request labels May 8, 2024
@TheTechromancer
Copy link
Collaborator

Hey @smithdavida, thanks for the suggestion! Fofa looks like a pretty cool service.

Are you interested in writing the module? We are always looking for help in that department. It should be pretty easy, take a look at our shodan module and let me know what you think. Fofa should be pretty similar!

@smithdavida
Copy link
Author

I'm glad you accepted my suggestion!I completed the code to be able to run locally:
`import requests
import base64
from urllib.parse import urlparse

watched_events = ["DNS_NAME"]
produced_events = ["DNS_NAME"]
flags = ["affiliates", "subdomain-enum", "passive", "safe"]
meta = {"description": "Query Fofa's API for subdomains", "auth_required": True}
baseurl = "https://fofa.info/api/v1/search/all"

def query(domain):
key = "xxxxxxxxxxxxx"
query_str = f"domain={domain}"
encoded_query_str = base64.b64encode(query_str.encode()).decode()
qbase64 = f"{encoded_query_str}"
params = {
"size": 10000,
"key": key,
"qbase64": qbase64
}
response = requests.get(url, params=params)
return response.json()

def extract_domains(fofa_results):
domains = set()
for result in fofa_results["results"]:
domain = urlparse(result[0]).netloc
domains.add(domain)
return list(domains)

fofa_results = query("example.com")
domains = extract_domains(fofa_results)
print(domains)`

The output is similar to this:
[ 'example.com', 'www.example.com', 'mail.example.com']

@TheTechromancer
Copy link
Collaborator

Would you be so kind as to put that in a pull request? 😁🙏

# ...fork bbot
# clone your fork 
git clone git@github.com:smithdavida/bbot && cd bbot
# create new branch
git switch -c fofa-module
# add your module 
git add bbot/modules/fofa.py
# commit and push changes
git commit -m "added fofa module"
git push

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
module todo Idea for new module or improvement to an existing one
Projects
None yet
Development

No branches or pull requests

2 participants