Crystal is a new, compiled programming language that aims to mimic the Ruby syntax as closely as possible. Recently, @mil0sec wrote a Shodan client library for Crystal and to get a better feel for it I wanted to write a “Hello World” equivalent in the security world: a subdomain enumeration tool. I’ll be cheating a bit in that we’re going to use the Shodan API to do so. The final command will work as follows:
$ bin/subs
Usage: subs <api key> <domain>
$ bin/subs YOUR_API_KEY cnn.com
ablink.emailalerts.cnn.com
admin.ref.alertshub.cnn.com
agility.cnn.com
alertshub.cnn.com
amp-ref.cnn.com
amp-staging.cnn.com
api.electiontracker.cnn.com
api.etp.cnn.com
api.platform.cnn.com
app.cnnespanol.cnn.com
apps.money.cnn.com
audience.qa.cnn.com
bea4c.cnn.com
c.bea4.cnn.com
ca.commerce.cnn.com
...
You can also skip ahead and check out the code at:
https://github.com/shodan-labs/crystal-subs
The tool requires having at least a Shodan Membership.
Installing Crystal
Follow the instructions for your operating system on how to install the Crystal language. In my case, I followed the directions for Ubuntu which were straight-forward enough:
curl -sSL https://dist.crystal-lang.org/apt/setup.sh | sudo bash
Initializing the project
To create the basic structure of a Crystal application we will be using the crystal command as follows:
crystal init app subs
This will create all the necessary files to have our own command-line application and setup the initial shards.yml where we define our dependencies. The subs command is very simple so the only dependency we need to add is for the Shodan library. To do so edit the shards.yml file by adding:
dependencies:
shodan:
github: percussiveelbow/shodan
After you’ve done so run the following command from within the subs directory to actually install the new dependency:
shards install
To make sure everything’s working as intended so far try running the following command to confirm that Crystal is able to compile the current code:
crystal run src/subs.cr
It should run without showing any messages (good or bad).
Adding Shodan DNSDB
Now for the actual program! Follow the in-line comments for an explanation of what’s actually going on:
We can test the program by running the command:
crystal run src/subs.cr -- APIKEY cnn.com
If everything works as intended then you will see a list of subdomains for cnn.com. At this point, we can also create a standalone binary file:
crystal build --release src/subs.cr
And we’re done! We now have a compiled binary that will grab a list of subdomains. You can confirm that it’s still working as before by running:
bin/subs APIKEY cnn.com
It was fun learning a new language and exploring some of the Crystal library for Shodan. Check it out and let us know what you create! And thank you to @mil0sec for creating the library and sharing it with the community.