Get related domains / subdomains by looking at Google Analytics IDs

Overview

AnalyticsRelationships

This script try to get related domains / subdomains by looking at Google Analytics IDs from a URL. First search for ID of Google Analytics in the webpage and then request to builtwith and hackertarget with the ID.



Note: It does not work with all websites. It is searched by the following expressions:

->  "www\.googletagmanager\.com/ns\.html\?id=[A-Z0-9\-]+"
-> GTM-[A-Z0-9]+
->  "UA-\d+-\d+"

Available versions:

Installation:

Installation according to language.

Python

> git clone https://github.com/Josue87/AnalyticsRelationships.git
> cd AnalyticsRelationships/Python
> sudo pip3 install -r requirements.txt

GO

> git clone https://github.com/Josue87/AnalyticsRelationships.git
> cd AnalyticsRelationships/
> go build -ldflags "-s -w"

Docker

> git clone https://github.com/Josue87/AnalyticsRelationships.git
> cd AnalyticsRelationships
> docker build -t analyticsrelationships:latest . 

Usage

Usage according to language

Python

> python3 analyticsrelationships.py -u https://www.example.com

Or redirect output to a file (banner or information messages are sent to the error output):

python3 analyticsrelationships.py -u https://www.example.com > /tmp/example.txt

GO

>  ./analyticsrelationships --url https://www.example.com

Or redirect output to a file (banner or information messages are sent to the error output):

>  ./analyticsrelationships --url https://www.example.com > /tmp/example.txt

You can also pass a file as input

>  cat file.txt | ./analyticsrelationships 

Or a single URL

>  echo https://www.example.com | ./analyticsrelationships 

Docker

Only Python Version.

>  docker run -it  analyticsrelationships:latest https://www.example.com

Or redirect output to a file (banner or information messages are sent to the error output):

>  docker run -it  analyticsrelationships:latest https://www.example.com > /tmp/example.txt

Examples

Python

Output redirection to file /tmp/example.txt:

image

Without redirection:

image

GO

Without redirection:

image

Working with file redirection works just like in Python.

An example with a file:

image

Disclaimer!

This is a PoC. The author is not responsible for any illegitimate use.

You might also like...
Data Connector is a Google Sheets Add-on that lets you import (and export) data to/from Google Sheets

Data Connector Data Connector is a Google Sheets Add-on that lets you import (and export) data to/from Google Sheets. Our roadmap: Connect to JSON/XML

A library for the MIGP (Might I Get Pwned) protocolA library for the MIGP (Might I Get Pwned) protocol

MIGP library This contains a library for the MIGP (Might I Get Pwned) protocol. MIGP can be used to build privacy-preserving compromised credential ch

A Caddy v2 plugin to track requests in Pirsch analytics

caddy-pirsch-plugin A Caddy v2 plugin to track requests in Pirsch Analytics. Usage pirsch [matcher] { client_id pirsch-client-id client_se

A minimal analytics package to start collecting traffic data without client dependencies.

go-web-analytics A minimal analytics package to start collecting traffic data without client dependencies. Logging incoming requests import "github.co

This project provides fully automated one-click experience to create Cloud and Kubernetes environment to run Data Analytics workload like Apache Spark.
This project provides fully automated one-click experience to create Cloud and Kubernetes environment to run Data Analytics workload like Apache Spark.

Introduction This project provides a fully automated one-click tool to create Data Analytics platform in Cloud and Kubernetes environment: Single scri

gophertunnel is composed of several packages that may be of use for creating Minecraft related tools
gophertunnel is composed of several packages that may be of use for creating Minecraft related tools

gophertunnel is composed of several packages that may be of use for creating Minecraft related tools. A brief overview of all packages may be found here.

🎉 An awesome version control tool for protoc and its related plugins.
🎉 An awesome version control tool for protoc and its related plugins.

❤️ PowerProto is actively maintained! Any questions in use can be directly raised issue, I will respond to you as fast as possible. If you think the p

🌍 Package tcplisten provides a customizable TCP net.Listener with various performance-related options

Package tcplisten provides customizable TCP net.Listener with various performance-related options: SO_REUSEPORT. This option allows linear scaling ser

Grpc bridge to various mediabank related systems

Mediabank bridge This internal tool enables authenticated gRPC based endpoint for securely communicating with systems like: Telestream Vantage Workflo

Comments
  • Save clean output as .txt

    Save clean output as .txt

    Save clean output as .txt:

    cat analytics_subs_tmp.txt | sed "s/|__//" | sed '/^[/d' | grep -P "^.[^.]+.[a-zA-Z]{3}$|^.[^.]+.[a-zA-Z]{2}.[a-zA-Z]{2}$" | anew -q analytics_subs.txt

    opened by satishshekher99 1
  • Introduced

    Introduced "--chain-mode" and some upgrades

    I added --chain-mode so that this project may be more easily chained with other projects, by only outputting the important things (results) when this flag is enabled.

    I also added short and long forms for the usage flags. Corrected "usage" text accordingly.

    I did some code cleanup and patched some bugs as well.

    opened by ItsIgnacioPortal 1
  • SyntaxError

    SyntaxError

    Hi, when running the script this error message appears:

    File "analyticsrelationships.py", line 12 SyntaxError: Non-ASCII character '\xe2' in file analyticsrelationships.py on line 13, but no encoding declared; see http://python.org/dev/peps/pep-0263/ for details

    How to fix it?

    thx

    opened by OSINT-d 1
  • Goreleaser

    Goreleaser

    With this github action, everytime a new release of AnalyticsRelationships is made on the releases tab, goreleaser will automatically compile and add standalone executables according to its config, creating pre-compiled binaries for many platforms. Like this.

    I'm adding this as a separate PR because it needs some action from your part @Josue87: You have to go to these repository's settings and add a github secret named GITHUBTOKEN with all the permissions under repo . After that's done, just merge this PR and create a new release on the releases tab.

    Here's some example token configuration that would work: example token config

    You can create the token on this page Add it to this project here

    More info here:

    • https://github.com/marketplace/actions/goreleaser-action
    • https://docs.github.com/en/actions/security-guides/encrypted-secrets
    • https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token

    TL;RD: Only you will be able to access the secret if you set it up with the instructions I gave.

    opened by ItsIgnacioPortal 1
Owner
Josué Encinar
Offensive Security Engineer
Josué Encinar
Godaddy-domains-client-go - Godaddy domains api Client golang - Write automaticly from swagger codegen

Go API client for swagger Overview This API client was generated by the swagger-codegen project. By using the swagger-spec from a remote server, you c

Mickael Stanislas 0 Jan 9, 2022
Given a list of domains, you resolve them and get the IP addresses.

resolveDomains Given a list of domains, you resolve them and get the IP addresses. Installation If you want to make modifications locally and compile

Josué Encinar 33 Oct 19, 2022
Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.

Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • License • Join Discord Subfinder is a subdomain discovery tool that

ProjectDiscovery 6.6k Dec 1, 2022
Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

gilfoyle97 537 Dec 2, 2022
Subdomain scanner, asynchronous dns packets, use pcap to scan 1600,000 subdomains in 1 second

ksubdomain是一款基于无状态的子域名爆破工具,类似无状态端口扫描,支持在Windows/Linux/Mac上进行快速的DNS爆破,在Mac和Windows上理论最大发包速度在30w/s,linux上为160w/s。 hacking8信息流的src资产收集 https://i.hacking8

boyhack 544 Nov 25, 2022
Generate wordlist from already collected subdomains for bruteforcing purposes.

goSubsWordlist Generate a wordlist from a list of already discovered subdomains. This list can be used for further bruteforcing for more subdomains. I

kenjoe41 4 Sep 25, 2022
Subfinder is a subdomain discovery tool that discovers valid subdomains for websites by using passive online sources

Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.

ProjectDiscovery 6.6k Dec 2, 2022
ScriptTiger 20 Sep 23, 2022
Coredns plugin for relaying .local domains

CoreDNS Local_Query This is a plugin for coredns that was developed to allow for the use of naked hosts in place of .local domains i.e example.local b

null 0 Nov 4, 2021
TLDs finder: check domain name availability across all valid top-level domains

TLD:er TLDs finder — check domain name availability across all valid top-level d

Dwi Siswanto 50 Oct 31, 2022