About HEDnsExtractor

HEDnsExtractor is a powerful domain name and IP security assessment tool that uses to the capabilities provided by the Hurricane Electric portal to help a wide range of researchers quickly identify network systems and IP addresses and perform security assessments, scans, and analyses of targeted networks.

Function

1、Support automatic identification of the IP address of the target network system through command line parameters or STDIN;

2、Support the extraction of target network system information based on IP address;

3、Support the extraction of relevant domain names from the target network;

Tool Installation

Since the tool is based on Go language development, we first need to install and configure the Go v1.2 language environment on the local device.

Next, the majority of researchers can directly use the following commands to clone the project's source code locally:

git clone https://github.com/HuntDownProject/HEDnsExtractor.git

In addition to this, we can also install HEDnsExtractor directly using the go install command:

go install -v github.com/HuntDownProject/hednsextractor/cmd/hednsextractor@latest

Help in using the tool

The following commands allow you to view tool help information directly:

usage -h

Tool help information is provided below:

HEDnsExtractor - Raw html extractor from Hurricane Electric portal!

 

Usage.

  hednsextractor [flags]

 

Flags.

CONFIGURATION.

   -vt-api-key string Virustotal API key

 

OTHER OPTIONS.

   -only-domains Display only domain names.

   -only-networks Display only network system information.

   -vt Show Virustotal rating

   -vt-score string Minimum Virustotal rating to display (default is "0")

   -target string The target IP address or network system to query.

   -silent Show silent mode output

   -verbose Display Verbose mode output.

Tool Running

Get the IP address used by hackerone.com and enumerate only network systems:

nslookup hackerone.com | awk '/Address: / {print $2}' | hednsextractor -silent -only-networks

 

[INF] [104.16.99.52] 104.16.0.0/12

[INF] [104.16.99.52] 104.16.96.0/20

Get the IP address used by hackerone.com and enumerate only the domain names (you can use the tail command to display the first ten results)：

nslookup hackerone.com | awk '/Address: / {print $2}' | hednsextractor -silent -only-domains | tail -n 10

 

herllus.com

hezzy.store

hilariostore.com

hiperdrop.com

hippratas.online

hitsstory.com

hobbyshop.site

holyangelstore.com

holzfallerstore.fun

homedescontoo.com

Used in conjunction with Virustotal

Edit the tool configuration file config.yaml and add your Virustotal API key:

cat $HOME/.config/hednsextractor/config.yaml

The contents of the document are as follows:

# hednsextractor configuration file

# generated by https://github.com/projectdiscovery/goflags

 

# only-domains

#only-domains: false

 

# only-domains: false

#only-networks: false

 

# show virustotal ratings

#vt: false

 

# Minimum Virustotal score to display

#vt-score: 0

 

# target-ip-address-or-network-system to query

#target.

 

#vt-score: 0 # Target IP address or network system to query #target: false # Display silent mode output

#silent: false

 

# Display Verbose mode output

#verbose: false

 

# Virustotal API key

vt-api-key: Your API Key goes here

The output of the tool after running is as follows:

_______  ______   _        _______  _______          _________ _______  _______  _______ _________ _______  _______

|\     /|(  ____ \(  __  \ ( (    /|(  ____ \(  ____ \|\     /|\__   __/(  ____ )(  ___  )(  ____ \\__   __/(  ___  )(  ____ )

| )   ( || (    \/| (  \  )|  \  ( || (    \/| (    \/( \   / )   ) (   | (    )|| (   ) || (    \/   ) (   | (   ) || (    )|

| (___) || (__    | |   ) ||   \ | || (_____ | (__     \ (_) /    | |   | (____)|| (___) || |         | |   | |   | || (____)|

|  ___  ||  __)   | |   | || (\ \) |(_____  )|  __)     ) _ (     | |   |     __)|  ___  || |         | |   | |   | ||     __)

| (   ) || (      | |   ) || | \   |      ) || (       / ( ) \    | |   | (\ (   | (   ) || |         | |   | |   | || (\ (   

| )   ( || (____/\| (__/  )| )  \  |/\____) || (____/\( /   \ )   | |   | ) \ \__| )   ( || (____/\   | |   | (___) || ) \ \__

|/     \|(_______/(______/ |/    )_)\_______)(_______/|/     \|   )_(   |/   \__/|/     \|(_______/   )_(   (_______)|/   \__/

 

[INF] Current hednsextractor version v1.0.0

[INF] [104.16.0.0/12] domain: ohst.ltd VT Score: 0

[INF] [104.16.0.0/12] domain: jxcraft.net VT Score: 0

[INF] [104.16.0.0/12] domain: teatimegm.com VT Score: 2

[INF] [104.16.0.0/12] domain: debugcheat.com VT Score: 0

Screenshots of the tool in action

license agreement

This project is developed and distributed under the GPL-3.0 open source license agreement.

Project Address

HEDnsExtractor：【GitHub Portal】