获取子域名列表

get_subdomains.js

const superagent = require('superagent');
const cheerio = require('cheerio');

const getSubdomains = (rootDomain) => {
  return new Promise((resolve, reject) => {
    superagent
      .post('https://hackertarget.com/find-dns-host-records/')
      .type('form')
      .send({ theinput: rootDomain })
      .send({ thetest: 'hostsearch' })
      .send({ name_of_nonce_field: '455c07ae2f' })
      .send({ _wp_http_referer: '/find-dns-host-records' })
      .then(data => {
        let $ = cheerio.load(data.text);
        let raw = $($('pre#formResponse')[0]).text().split('\n');
        raw.pop();
        let domains = [];
        for (let i = 0; i < raw.length; i++) domains.push(raw[i].split(',')[0]);
        return domains;
      })
      .then(data => resolve(data))
      .catch(err => reject(err));
  });
}