Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,17 +14,35 @@ pip install openai

- An OpenAI API key. You can obtain this from the OpenAI website.



To install the free method without OpenAI, use the following command

- Install the opencode

```bash
curl -fsSL https://opencode.ai/install | bash
```

## Usage

You can run the script from the command line like this:

```bash
chaos -d yourdomain.com | python subrecongpt.py --apikey YOUR_OPENAI_API_KEY
chaos -d yourdomain.com | python subrecongpt.py --mode openai --apikey YOUR_OPENAI_API_KEY
```

Replace yourdomain.com with the domain you're investigating and YOUR_OPENAI_API_KEY with your actual OpenAI API key.

This command will run Chaos on yourdomain.com, and then pipe the output into the Python script. The script will generate similar subdomains for each subdomain output by Chaos, and then attempt to resolve these new subdomains.


When running without OpenAI, use the following command

```bash
subfinder -d yourdomain.com | python3 subrecongpt-test.py
```

## Output
For each input subdomain, the script will print out the AI's guesses for similar subdomains and whether each guess resolves:

Expand Down
10 changes: 10 additions & 0 deletions subdomains.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
bughxcazoqtj.vulnweb.com
bughxcazoqtj1.vulnweb.com
bughxcazoqtj2.vulnweb.com
bughxcazoqtj-dev.vulnweb.com
bughxcazoqtj-test.vulnweb.com
bughxcazoqtj-staging.vulnweb.com
bughxcazoqtj-prod.vulnweb.com
bughxcazoqtj-api.vulnweb.com
bughxcazoqtj-web.vulnweb.com
bughxcazoqtj-app.vulnweb.com
49 changes: 28 additions & 21 deletions subrecongpt.py
Original file line number Diff line number Diff line change
Expand Up @@ -3,29 +3,35 @@
import argparse
import sys
import time
from os import popen


def generate_subdomains(subdomain, domain, api_key):
def generate_subdomains(subdomain, domain, api_key=None, mode=None):
openai.api_key = api_key
while True: # Continue trying until a successful API call is made
try:
response = openai.ChatCompletion.create(
model="gpt-3.5-turbo",
messages=[
{"role": "system", "content": "You are a helpful assistant."},
{"role": "user", "content": f"Generate 5 subdomains similar to {subdomain}."},
],
)
ai_generated_subdomains = [f"{sub}.{domain}" for sub in response['choices'][0]['message']['content'].strip().split('\n')]

return ai_generated_subdomains
except openai.error.RateLimitError as e:
print("Rate limit exceeded. Sleeping for 20 seconds...")
time.sleep(20) # Sleep for 20 seconds and then try again
except Exception as e:
print(f"An unexpected error occurred: {e}")
raise e # If it's a different kind of error, raise it
if mode == 'openai':
print("Here")
while True: # Continue trying until a successful API call is made
try:
response = openai.ChatCompletion.create(
model="gpt-3.5-turbo",
messages=[
{"role": "system", "content": "You are a helpful assistant."},
{"role": "user", "content": f"Generate 5 subdomains similar to {subdomain}."},
],
)
ai_generated_subdomains = [f"{sub}.{domain}" for sub in response['choices'][0]['message']['content'].strip().split('\n')]

return ai_generated_subdomains
except openai.error.RateLimitError as e:
print("Rate limit exceeded. Sleeping for 20 seconds...")
time.sleep(20) # Sleep for 20 seconds and then try again
except Exception as e:
print(f"An unexpected error occurred: {e}")
raise e # If it's a different kind of error, raise it
else:
subdomains = popen(f"opencode run 'Generate exactly 10 subdomains based on \"{subdomain}\" and return full domain names like subdomain.{domain}. Do not return only the subdomain part. Output only one full domain per line, no explanations or extra text.'").read()
ai_generated_subdomains = [line.strip() for line in subdomains.splitlines() if line.strip()]
return ai_generated_subdomains

def resolve_subdomains(subdomains):
resolved_subdomains = []
Expand All @@ -44,7 +50,8 @@ def resolve_subdomains(subdomains):

def main():
parser = argparse.ArgumentParser(description='AI-assisted subdomain discovery.')
parser.add_argument('--apikey', required=True, help='OpenAI API key.')
parser.add_argument('--apikey', required=False, help='OpenAI API key.')
parser.add_argument('--mode', required=False, help='AI selection mode.')
args = parser.parse_args()

lines = [line.strip() for line in sys.stdin]
Expand All @@ -55,7 +62,7 @@ def main():
continue
subdomain, domain = line.split('.', 1) # Split the line into subdomain and domain
print(f"\nSubdomain = {subdomain}.{domain}")
new_subdomains = generate_subdomains(subdomain, domain, args.apikey)
new_subdomains = generate_subdomains(subdomain, domain, mode=args.mode, api_key=args.apikey )
print(f"Guesses: {', '.join([sub.split('.')[0] for sub in new_subdomains])}\n")
resolved_subdomains = resolve_subdomains(new_subdomains)
time.sleep(1) # Pause for 1 second
Expand Down