URLPartialEnum

URLPartialEnum.py

import requests
from concurrent.futures import ThreadPoolExecutor
import argparse
from colorama import init, Fore, Style

# Initialize colorama for cross-platform ANSI support
init(autoreset=True)

# Azure-related domain suffixes
AZURE_DOMAINS = [
    # Authentication and Identity
    "login.microsoftonline.com",
    "login.live.com",
    "aadcdn.msftauth.net",
    "aadcdn.msftauthimages.net",
    "aadcdn.msauthimages.net",
    "logincdn.msftauth.net",
    "msauth.net",
    "aadcdn.microsoftonline-p.com",
    "microsoftonline-p.com",
    "graph.windows.net",
    "graph.microsoft.com",
    "account.microsoft.com",
    "signup.azure.com",
    "aad.azure.com",
    "aadconnecthealth.azure.com",
    "ad.azure.com",
    "api.aadrm.com",
    "api.azrbac.mspim.azure.com",
    "appmanagement.activedirectory.microsoft.com",
    "identitygovernance.azure.com",
    "iga.azure.com",
    "informationprotection.azure.com",

    # Azure Portal and Management
    "portal.azure.com",
    "hosting.portal.azure.net",
    "reactblade.portal.azure.net",
    "management.azure.com",
    "ext.azure.com",
    "hosting.partners.azure.net",
    "subscriptionrp.trafficmanager.net",

    # Azure Services
    "azure-api.net",
    "biztalk.windows.net",
    "blob.core.windows.net",
    "file.core.windows.net",
    "queue.core.windows.net",
    "table.core.windows.net",
    "cloudapp.net",
    "cloudapp.azure.com",
    "azurecr.io",
    "azurecontainer.io",
    "vo.msecnd.net",
    "cosmos.azure.com",
    "documents.azure.com",
    "vault.azure.net",
    "azmk8s.io",
    "management.core.windows.net",
    "origin.mediaservices.windows.net",
    "azure-mobile.net",
    "servicebus.windows.net",
    "database.windows.net",
    "azureedge.net",
    "trafficmanager.net",
    "azurewebsites.net",
    "scm.azurewebsites.net",
    "visualstudio.com",
    "asazure.windows.net",
    "azconfig.io",
    "applicationinsights.azure.com",
    "appservice.azure.com",
    "arc.azure.net",
    "bastion.azure.com",
    "batch.azure.com",
    "catalogapi.azure.com",
    "catalogartifact.azureedge.net",
    "changeanalysis.azure.com",
    "cognitiveservices.azure.com",
    "config.office.com",
    "datalake.azure.net",
    "dev.azure.com",
    "dev.azuresynapse.net",
    "digitaltwins.azure.net",
    "elm.iga.azure.com",
    "eventhubs.azure.net",
    "functions.azure.com",
    "gallery.azure.com",
    "go.microsoft.com",
    "help.kusto.windows.net",
    "kusto.windows.net",
    "learn.microsoft.com",
    "logic.azure.com",
    "marketplacedataprovider.azure.com",
    "main.prod.marketplacedataprovider.azure.com",
    "store-images.s-microsoft.com",
    "windows.cloud.microsoft",
    "windows365.microsoft.com",
    "ecs.office.com",
    "sharepoint.com",
    "events.data.microsoft.com",
    "cdn.office.net",
    "msftconnecttest.com",
    "prod.do.dsp.mp.microsoft.com",
    "sfx.ms",
    "digicert.com",
    "azure-dns.com",
    "azure-dns.net",
    "eh.servicebus.windows.net",
    "wvd.microsoft.com",
    "wvd.azure.us",
    "servicebus.usgovcloudapi.net",
    "privacy.microsoft.com",
    "oneocsp.microsoft.com",
    "ctldl.windowsupdate.com",
    "ocsp.msocsp.com",
    "oneclient.sfx.ms",
    "web.core.windows.net",
    "web.core.windows.net",
    "scus.web.core.windows.net",
    "z7.web.core.windows.net",
    "z13.web.core.windows.net",
    "z22.web.core.windows.net",
    "catalogartifact.azureedge.net"
]

def check_url(url):
    try:
        response = requests.get(url, timeout=5)
        return (url, response.status_code)
    except requests.RequestException:
        return (url, None)

def colorize(status, url):
    if status is None:
        return f"{Fore.RED}[-] {url} --> No response{Style.RESET_ALL}"
    elif status == 200:
        return f"{Fore.GREEN}[+] {url} --> HTTP {status}{Style.RESET_ALL}"
    else:
        return f"{Fore.YELLOW}[!] {url} --> HTTP {status}{Style.RESET_ALL}"

def main(url):
    urls = [f"https://{url}.{domain}" for domain in AZURE_DOMAINS]
    print(f"[+] Checking {len(urls)} URLs...\n")

    with ThreadPoolExecutor(max_workers=20) as executor:
        results = executor.map(check_url, urls)

    for url, status in results:
        print(colorize(status, url))

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="Azure URL Enumeration")
    parser.add_argument("--url", required=True, help="url subdomain (e.g., wklstgkgucfotilx1344634)")
    args = parser.parse_args()
    main(args.url)