i Knockpy – Enumerate Subdomain Scanner – All things in moderation

Knockpy – Enumerate Subdomain Scanner

What is Knockpy?
Knockpy is a python tool designed to enumerate subdomains on a target domain through a wordlist. It is designed to scan for DNS zone transfer and to try to bypass the wildcard DNS record automatically if it is enabled. Now knockpy supports queries to VirusTotal subdomains, you can setting the API_KEY within the config.json file.

How to install Knockpy?
Prerequisites
Python 2.7.6
Check version Python with command:
$python –version

Dependencies
Dnspython
$ sudo apt-get install python-dnspython


Installing
Download Knock:
$ git clone https://github.com/guelfoweb/knock.git

Install Knockpy:
$ cd knock
$ nano knockpy/config.json

Set your virustotal API_KEY

Sign in with your account. Goto link: https://www.virustotal.com/#/settings/apikey get API_KEY.

Next, install Knockpy:
$ python setup.py install

Knockpy arguments

$ knockpy -h
usage: knockpy [-h] [-v] [-w WORDLIST] [-r] [-c] [-f] [-j] domain

___________________________________________

knock subdomain scan
knockpy v.4.1.1
Author: Gianni 'guelfoweb' Amato
Github: https://github.com/guelfoweb/knock
___________________________________________

positional arguments:
  domain           target to scan, like domain.com

optional arguments:
  -h, --help       show this help message and exit
  -v, --version    show program's version number and exit
  -w WORDLIST      specific path to wordlist file
  -r, --resolve    resolve single ip or domain name
  -c, --csv        save output in csv
  -f, --csvfields  add fields name to the first row of csv output file
  -j, --json       export full report in JSON

example:
  knockpy domain.com
  knockpy domain.com -w wordlist.txt
  knockpy -r domain.com or IP
  knockpy -c domain.com
  knockpy -j domain.com

For virustotal subdomains support you can setting your API KEY in the
config.json file.
 

Example
$ knockpy domainname.com
Start:

Finish:

Subdomain scan with external wordlist
$ knockpy domain.com -w wordlist.txt

Resolve domain name and get response headers
$ knockpy -r domain.com [or IP]

Save scan output in CSV
$ knockpy -c domain.com

Export full report in JSON
$ knockpy -j domain.com

Leave a Reply