Very simply

$ knockpy domain.com

Export full report in JSON
If you want to save full log like this one just type:

$ knockpy domain.com --json

Install
Prerequisites

• Python 2.7.6

Dependencies

• Dnspython

$ sudo apt-get install python-dnspython

Installing

$ git clone https://github.com/guelfoweb/knock.git
 
 $ cd knock
 
 $ nano knockpy/config.json <- set your virustotal API_KEY
 
 $ sudo python setup.py install

Note that it's recommended to use Google DNS: 8.8.8.8 and 8.8.4.4


Knockpy arguments

$ knockpy -h
 usage: knockpy [-h] [-v] [-w WORDLIST] [-r] [-c] [-j] domain
 
 ___________________________________________
 
 knock subdomain scan
 knockpy v.4.1
 Author: Gianni 'guelfoweb' Amato
 Github: https://github.com/guelfoweb/knock
 ___________________________________________
 
 positional arguments:
   domain         target to scan, like domain.com
 
 optional arguments:
   -h, --help      show this help message and exit
   -v, --version   show program's version number and exit
   -w WORDLIST     specific path to wordlist file
   -r, --resolve   resolve ip or domain name
   -c, --csv       save output in csv
   -f, --csvfields add fields name to the first row of csv output file
   -j, --json      export full report in JSON
 
 example:
   knockpy domain.com
   knockpy domain.com -w wordlist.txt
   knockpy -r domain.com or IP
   knockpy -c domain.com
   knockpy -j domain.com

For virustotal subdomains support you can setting your API_KEY in the config.json file.


Example
Subdomain scan with internal wordlist

$ knockpy domain.com

Subdomain scan with external wordlist

$ knockpy domain.com -w wordlist.txt

Resolve domain name and get response headers

$ knockpy -r domain.com [or IP]

+ checking for virustotal subdomains: YES
 [
         "partnerissuetracker.corp.google.com",
         "issuetracker.google.com",
         "r5---sn-ogueln7k.c.pack.google.com",
         "cse.google.com",
 
         .......too long.......
 
         "612.talkgadget.google.com",
         "765.talkgadget.google.com",
         "973.talkgadget.google.com"
 ]
 + checking for wildcard: NO
 + checking for zonetransfer: NO
 + resolving target: YES
 {
         "zonetransfer": {
             "enabled": false,
             "list": []
         },
         "target": "google.com",
         "hostname": "google.com",
         "virustotal": [
             "partnerissuetracker.corp.google.com",
             "issuetracker.google.com",
             "r5---sn-ogueln7k.c.pack.google.com",
             "cse.google.com",
             "mt0.google.com",
             "earth.google.com",
             "clients1.google.com",
             "pki.google.com",
             "www.sites.google.com",
             "appengine.google.com",
             "fcmatch.google.com",
             "dl.google.com",
             "translate.google.com",
             "feedproxy.google.com",
             "hangouts.google.com",
             "news.google.com",
 
             .......too long.......
 
             "100.talkgadget.google.com",
             "services.google.com",
             "301.talkgadget.google.com",
             "857.talkgadget.google.com",
             "600.talkgadget.google.com",
             "992.talkgadget.google.com",
             "93.talkgadget.google.com",
             "storage.cloud.google.com",
             "863.talkgadget.google.com",
             "maps.google.com",
             "661.talkgadget.google.com",
             "325.talkgadget.google.com",
             "sites.google.com",
             "feedburner.google.com",
             "support.google.com",
             "code.google.com",
             "562.talkgadget.google.com",
             "190.talkgadget.google.com",
             "58.talkgadget.google.com",
             "612.talkgadget.google.com",
             "765.talkgadget.google.com",
             "973.talkgadget.google.com"
         ],
         "alias": [],
         "wildcard": {
             "detected": {},
             "test_target": "eqskochdzapjbt.google.com",
             "enabled": false,
             "http_response": {}
         },
         "ipaddress": [
             "216.58.205.142"
         ],
         "response_time": "0.0351989269257",
         "http_response": {
             "status": {
                 "reason": "Found",
                 "code": 302
             },
             "http_headers": {
                 "content-length": "256",
                 "location": "http://www.google.it/?gfe_rd=cr&ei=60WIWdmnDILCXoKbgfgK",
                 "cache-control": "private",
                 "date": "Mon, 07 Aug 2017 10:50:19 GMT",
                 "referrer-policy": "no-referrer",
                 "content-type": "text/html; charset=UTF-8"
             }
         }
 }

Save scan output in CSV

$ knockpy -c domain.com

Export full report in JSON

$ knockpy -j domain.com

Talk about
Ethical Hacking and Penetration Testing Guide Book by Rafay Baloch.
Knockpy comes pre-installed on the following security distributions for penetration test:

• BackBox Linux
• PentestBox for Windows
• Buscador Investigative Operating System

Other
This tool is currently maintained by Gianni 'guelfoweb' Amato, who can be contacted at [email protected] or twitter @guelfoweb. Suggestions and criticism are welcome.