What is this?
OneForAll is a powerful subdomain collection tool: point it at a target domain and it gathers subdomains from many sources — a core reconnaissance step in penetration testing, which is why the author built it.
OneForAll is a powerful subdomain collection tool: point it at a target domain and it gathers subdomains from many sources — a core reconnaissance step in penetration testing, which is why the author built it.Do I drive it from the terminal, or does it have a graphical interface?It is a pure command-line tool: oneforall.py is the entry point and the CLI is generated with Python Fire. There is no GUI yet — a friendly frontend is on the author's roadmap.
It is a pure command-line tool: oneforall.py is the entry point and the CLI is generated with Python Fire. There is no GUI yet — a friendly frontend is on the author's roadmap.How do I get it running?Clone the repo with git and install the dependencies with pip3 (there is also a Docker route). Then run: python3 oneforall.py --target example.com run — results are written to the results directory.
Clone the repo with git and install the dependencies with pip3 (there is also a Docker route). Then run: python3 oneforall.py --target example.com run — results are written to the results directory.What do I need installed first?Python above 3.6.0 with pip3 — the tool was developed and tested on Python 3.6.0. On Windows, if Python sits in Program Files, run cmd as administrator for the dependency install.
Python above 3.6.0 with pip3 — the tool was developed and tested on Python 3.6.0. On Windows, if Python sits in Program Files, run cmd as administrator for the dependency install.Do all the collection sources work out of the box?No — some modules need API keys, most of them free after a quick account registration; you configure them in api.py. Some interfaces are blocked in China, so set a proxy in setting.py; errors from unused sources can be ignored.
No — some modules need API keys, most of them free after a quick account registration; you configure them in api.py. Some interfaces are blocked in China, so set a proxy in setting.py; errors from unused sources can be ignored.Will it run on Windows, or is it a Linux-only tool?It is cross-platform: the README walks through a Windows pip3 install, and being Python 3-based it also runs on macOS and Linux — plus there is a Docker image for servers.
It is cross-platform: the README walks through a Windows pip3 install, and being Python 3-based it also runs on macOS and Linux — plus there is a Docker image for servers.How does it actually find subdomains?Via about 65 modules in seven categories: certificate transparency (crt.sh, censys and more), DNS datasets (24 modules like SecurityTrails and DNSDumpster), 18 search engines (Google, Bing, GitHub and more), threat intel platforms (VirusTotal, AlienVault), DNS queries for SRV, MX, NS, SOA and TXT records, zone transfers and NSEC walking, plus web archives — and it also brute-forces with dictionaries and fuzz mode, crawls page and JS content, and permutes known subdomains.
Via about 65 modules in seven categories: certificate transparency (crt.sh, censys and more), DNS datasets (24 modules like SecurityTrails and DNSDumpster), 18 search engines (Google, Bing, GitHub and more), threat intel platforms (VirusTotal, AlienVault), DNS queries for SRV, MX, NS, SOA and TXT records, zone transfers and NSEC walking, plus web archives — and it also brute-forces with dictionaries and fuzz mode, crawls page and JS content, and permutes known subdomains.How fast does it go through domains?Very fast: bruteforcing is delegated to massdns, which resolves more than 350,000 domains per second, collection modules run on multiple threads, and verification DNS and HTTP checks use async coroutines.
Very fast: bruteforcing is delegated to massdns, which resolves more than 350,000 domains per second, collection modules run on multiple threads, and verification DNS and HTTP checks use async coroutines.Does it check for subdomain takeover?Yes — takeover risk checks are enabled by default and support batch checking. It can even attempt automatic takeover of vulnerable subdomains, though for now that only works for Github and is still being improved.
Yes — takeover risk checks are enabled by default and support batch checking. It can even attempt automatic takeover of vulnerable subdomains, though for now that only works for Github and is still being improved.Can I point it at any domain I want?No. The README's disclaimer says the tool may only be used in legally authorized enterprise security work, and you alone are responsible for keeping your actions within local laws — the developers take no liability.
No. The README's disclaimer says the tool may only be used in legally authorized enterprise security work, and you alone are responsible for keeping your actions within local laws — the developers take no liability.What are similar projects?bbot, theHarvester, Sublist3r, Sn1per, awesome-hacker-search-engines, maigret, amass, flowsint
bbot, theHarvester, Sublist3r, Sn1per, awesome-hacker-search-engines, maigret, amass, flowsintWhich topics is it in?brute-force, subdomain-enumeration, subdomain, pentest-tool, osint-tool, recon, bugbounty, information-gathering, reconnaissance, osint, python3, offensive-security
brute-force, subdomain-enumeration, subdomain, pentest-tool, osint-tool, recon, bugbounty, information-gathering, reconnaissance, osint, python3, offensive-security