-
Notifications
You must be signed in to change notification settings - Fork 317
/
Copy pathInvoke-EnumerateAzureSubDomains.ps1
164 lines (140 loc) · 7.19 KB
/
Invoke-EnumerateAzureSubDomains.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
<#
File: Invoke-EnumerateAzureSubDomains.ps1
Author: Karl Fosaaen (@kfosaaen), NetSPI - 2018
Description: PowerShell functions for enumerating Azure/Microsoft hosted resources.
Parts of the Permutations.txt file borrowed from - https://github.com/brianwarehime/inSp3ctor
#>
Function Invoke-EnumerateAzureSubDomains
{
<#
.SYNOPSIS
PowerShell function for enumerating public Azure services.
.DESCRIPTION
The function will check for valid Azure subdomains, based off of a base word, via DNS.
.PARAMETER Base
The Base name to prepend/append with permutations.
.PARAMETER Permutations
Specific permutations file to use. Default is permutations.txt (included in this repo)
.EXAMPLE
PS C:\> Invoke-EnumerateAzureSubDomains -Base test123 -Verbose
Invoke-EnumerateAzureSubDomains -Base test12345678 -Verbose
VERBOSE: Found test12345678.cloudapp.net
VERBOSE: Found test12345678.scm.azurewebsites.net
VERBOSE: Found test12345678.onmicrosoft.com
VERBOSE: Found test12345678.database.windows.net
VERBOSE: Found test12345678.mail.protection.outlook.com
VERBOSE: Found test12345678.queue.core.windows.net
VERBOSE: Found test12345678.blob.core.windows.net
VERBOSE: Found test12345678.file.core.windows.net
VERBOSE: Found test12345678.vault.azure.net
VERBOSE: Found test12345678.table.core.windows.net
VERBOSE: Found test12345678.azurewebsites.net
VERBOSE: Found test12345678.documents.azure.com
VERBOSE: Found test12345678.azure-api.net
VERBOSE: Found test12345678.sharepoint.com
Subdomain Service
--------- -------
test12345678.azure-api.net API Services
test12345678.cloudapp.net App Services
test12345678.scm.azurewebsites.net App Services
test12345678.azurewebsites.net App Services
test12345678.documents.azure.com Databases-Cosmos DB
test12345678.database.windows.net Databases-MSSQL
test12345678.mail.protection.outlook.com Email
test12345678.vault.azure.net Key Vaults
test12345678.onmicrosoft.com Microsoft Hosted Domain
test12345678.sharepoint.com SharePoint
test12345678.queue.core.windows.net Storage Accounts
test12345678.blob.core.windows.net Storage Accounts
test12345678.file.core.windows.net Storage Accounts
test12345678.table.core.windows.net Storage Accounts
.LINK
https://blog.netspi.com/enumerating-azure-services/
#>
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true,
ValueFromPipeline = $true,
ValueFromPipelineByPropertyName = $true,
HelpMessage="Base name to use.")]
[string]$Base = "",
[Parameter(Mandatory=$false,
HelpMessage="Specific permutations file to use.")]
[string]$Permutations = "$PSScriptRoot\permutations.txt"
)
# Domain = Service hashtable for easier lookups
$subLookup = @{'onmicrosoft.com'='Microsoft Hosted Domain';
'scm.azurewebsites.net'='App Services - Management';
'azurewebsites.net'='App Services';
'p.azurewebsites.net'='App Services';
'cloudapp.net'='App Services';
'file.core.windows.net'='Storage Accounts - Files';
'blob.core.windows.net'='Storage Accounts - Blobs';
'queue.core.windows.net'='Storage Accounts - Queues';
'table.core.windows.net'='Storage Accounts - Tables';
'mail.protection.outlook.com'='Email';
'sharepoint.com'='SharePoint';
'redis.cache.windows.net'='Databases-Redis';
'documents.azure.com'='Databases-Cosmos DB';
'database.windows.net'='Databases-MSSQL';
'vault.azure.net'='Key Vaults';
'azureedge.net'='CDN';
'search.windows.net'='Search Appliance';
'azure-api.net'='API Services';
'azurecr.io'='Azure Container Registry'
}
$runningList = @()
$lookupResult = ""
if ($Permutations -and (Test-Path $Permutations)){
$PermutationContent = Get-Content $Permutations
}
else{Write-Verbose "No permutations file found"}
# Create data table to house results
$TempTbl = New-Object System.Data.DataTable
$TempTbl.Columns.Add("Subdomain") | Out-Null
$TempTbl.Columns.Add("Service") | Out-Null
$iter = 0
# Check Each Subdomain
$subLookup.Keys | ForEach-Object{
# Track the progress
$iter++
$subprogress = ($iter/$subLookup.Count)*100
Write-Progress -Status 'Progress..' -Activity "Enumerating $Base subdomains for $_ subdomain" -PercentComplete $subprogress
# Check the base word
$lookup = $Base+'.'+$_
try{($lookupResult = Resolve-DnsName $lookup -ErrorAction Stop -Verbose:$false -DnsOnly | select Name | Select-Object -First 1)|Out-Null}catch{}
if ($lookupResult -ne ""){
Write-Verbose "Found $lookup"; $runningList += $lookup
# Add to output table
$TempTbl.Rows.Add([string]$lookup,[string]$subLookup[$_]) | Out-Null
}
$lookupResult = ""
# Chek Permutations (postpend word, prepend word)
foreach($word in $PermutationContent){
# Storage Accounts can't have special characters
if(($_ -ne 'file.core.windows.net') -or ($_ -ne 'blob.core.windows.net')){
# Base-Permutation
$lookup = $Base+"-"+$word+'.'+$_
try{($lookupResult = Resolve-DnsName $lookup -ErrorAction Stop -Verbose:$false -DnsOnly | select Name | Select-Object -First 1)|Out-Null}catch{}
if ($lookupResult -ne ""){Write-Verbose "Found $lookup"; $runningList += $lookup; $TempTbl.Rows.Add([string]$lookup,[string]$subLookup[$_]) | Out-Null}
$lookupResult = ""
# Permutation-Base
$lookup = $word+"-"+$Base+'.'+$_
try{($lookupResult = Resolve-DnsName $lookup -ErrorAction Stop -Verbose:$false -DnsOnly | select Name | Select-Object -First 1)|Out-Null}catch{}
if ($lookupResult -ne ""){Write-Verbose "Found $lookup"; $runningList += $lookup; $TempTbl.Rows.Add([string]$lookup,[string]$subLookup[$_]) | Out-Null}
$lookupResult = ""
}
# PermutationBase
$lookup = $word+$Base+'.'+$_
try{($lookupResult = Resolve-DnsName $lookup -ErrorAction Stop -Verbose:$false -DnsOnly | select Name | Select-Object -First 1)|Out-Null}catch{}
if ($lookupResult -ne ""){Write-Verbose "Found $lookup"; $runningList += $lookup; $TempTbl.Rows.Add([string]$lookup,[string]$subLookup[$_]) | Out-Null}
$lookupResult = ""
# BasePermutation
$lookup = $Base+$word+'.'+$_
try{($lookupResult = Resolve-DnsName $lookup -ErrorAction Stop -Verbose:$false -DnsOnly | select Name | Select-Object -First 1)|Out-Null}catch{}
if ($lookupResult -ne ""){Write-Verbose "Found $lookup"; $runningList += $lookup; $TempTbl.Rows.Add([string]$lookup,[string]$subLookup[$_]) | Out-Null}
$lookupResult = ""
}
}
$TempTbl | sort Service
}