xtr3sor/dnstwist-ts
GitHub: xtr3sor/dnstwist-ts
DNSTwist 的 TypeScript 移植版，通过多种域名排列引擎生成变体列表以辅助检测钓鱼和品牌冒充。
Stars: 2 | Forks: 0
# dnstwist-ts
[DNSTwist](https://github.com/elceef/dnstwist) 的 TypeScript 移植版 - 用于检测域名抢注、钓鱼攻击和企业间谍活动的域名排列引擎。
## 概述
dnstwist-ts 是一个 TypeScript/JavaScript 库，用于生成域名变体，以帮助检测潜在的 typosquatting（域名错位抢注）、钓鱼攻击和品牌冒充。它是 [@elceef](https://github.com/elceef) 开发的热门 Python 工具 [dnstwist](https://github.com/elceef/dnstwist) 的直接移植版本。
## 功能
- **多种排列引擎**：元音交换、字符替换、Unicode 同形字等
- **基于字典的变体**：使用常用词汇和特定领域关键词的词表
- **支持自定义字典**：创建您自己的字典或从外部来源加载
- **Unicode 支持**：通过内置的 punycode 转换处理国际化域名 (IDN)
- **TypeScript 支持**：包含完整的类型定义
- **模块化设计**：可使用单独的引擎或根据需要进行组合
- **极简依赖**：仅需要 `tldts` 和 `punycode`
## 安装
```
npm install dnstwist-ts
```
## 使用说明
### 基本用法
```
import { generateDomainVariations } from "dnstwist-ts";
// Generate all possible variations
const variations = generateDomainVariations("example.com");
console.log(variations);
// Output: ['ex4mple.com', 'ex4mpl3.com', 'exampl3.com', ...]
```
### 带选项的高级用法
```
import { generateDomainVariations } from "dnstwist-ts";
// Generate variations with specific engines only
const variations = generateDomainVariations("example.com", {
includeVowelSwap: true,
includeGlyphs: true,
includeUnicode: false,
includeDictionary: true,
// ... other options
});
```
### 使用独立引擎
```
import {
engineVowelswap,
engineGlyphs,
engineUnicode,
engineDictionary,
} from "dnstwist-ts";
const domain = "example";
const vowelVariations = engineVowelswap(domain);
const glyphVariations = engineGlyphs(domain);
const unicodeVariations = engineUnicode(domain);
const dictVariations = engineDictionary(domain, "com");
```
### 简单的 Twist 函数
```
import { twistDomain } from "dnstwist-ts";
// Quick domain variations
const variations = twistDomain("google.com");
console.log(variations);
```
## 可用引擎
- **Vowel Swap**：交换域名中的元音字母 (a, e, i, o, u)
- **Glyphs**：使用视觉上相似的字符进行替换
- **Unicode**：进行 Unicode 同形字替换并转换为 punycode
- **Omission**：移除单个字符
- **Duplication**：复制单个字符
- **Addition**：在不同位置添加字符
- **Replacement**：用字母数字替代字符替换原字符
- **Bitsquatting**：比特级别的字符变体
- **Hyphenation**：在不同位置添加连字符
- **Subdomain**：创建子域名变体
- **Position Swap**：交换字符位置
- **Dictionary**：使用词表生成域名变体
- **Number to Letter**：将数字转换为外形相似的字母
- **Homoglyphs**：Unicode 字符替换
- **Common Misspellings**：常见拼写错误
- **TLD Fusion**：不同的顶级域名变体
- **Keyboard Shift**：相邻键盘按键替换
- **Letter Repetition**：常见字母重复模式
- **Letter Swap**：常见字母对交换
- **Common Typo**：常见输入错误模式
## API 参考
### `generateDomainVariations(domain: string, options?: Options): string[]`
使用指定的引擎生成域名变体。
**参数：**
- `domain`：要生成变体的目标域名
- `options`：可选的配置对象
**选项：**
```
interface Options {
includeVowelSwap?: boolean;
includeGlyphs?: boolean;
includeUnicode?: boolean;
includeOmission?: boolean;
includeDuplication?: boolean;
includeAddition?: boolean;
includeReplacement?: boolean;
includeBitsquatting?: boolean;
includeHyphenation?: boolean;
includeSubdomain?: boolean;
includePositionSwap?: boolean;
includeDictionary?: boolean;
includeNumberToLetter?: boolean;
includeHomoglyphs?: boolean;
includeCommonMisspellings?: boolean;
includeTldFusion?: boolean;
includeKeyboardShift?: boolean;
includeLetterRepetition?: boolean;
includeLetterSwap?: boolean;
includeCommonTypo?: boolean;
}
```
### `twistDomain(domain: string): string[]`
生成基础域名变体的简单函数。
### 独立引擎函数
所有引擎都可以作为独立函数使用：
- `engineVowelswap(domain: string): string[]`
- `engineGlyphs(domain: string): string[]`
- `engineUnicode(domain: string): string[]`
- `engineOmission(domain: string): string[]`
- `engineDuplication(domain: string): string[]`
- `engineAddition(domain: string): string[]`
- `engineReplacement(domain: string): string[]`
- `engineBitsquatting(domain: string): string[]`
- `engineHyphenation(domain: string): string[]`
- `engineSubdomain(domain: string): string[]`
- `enginePositionswap(domain: string): string[]`
- `engineDictionary(baseDomain: string, tld: string): string[]`
- `engineNumberToLetter(domain: string): string[]`
- `engineHomoglyphs(domain: string): string[]`
- `engineCommonMisspellings(domain: string): string[]`
- `engineTldFusion(domain: string, originalTld: string): string[]`
- `engineKeyboardShift(domain: string): string[]`
- `engineLetterRepetition(domain: string): string[]`
- `engineLetterSwap(domain: string): string[]`
- `engineCommonTypo(domain: string): string[]`
## 示例
### 基础域名变体
```
import { generateDomainVariations, twistDomain } from "dnstwist-ts";
// Simple domain variations
const variations = twistDomain("google.com");
console.log(variations);
// Output: ['g00gle.com', 'g0ogle.com', 'go0gle.com', 'googl3.com', ...]
// More comprehensive variations
const allVariations = generateDomainVariations("example.com");
console.log(`Generated ${allVariations.length} variations`);
```
### 检测潜在钓鱼域名
```
import { generateDomainVariations } from "dnstwist-ts";
const targetDomain = "paypal.com";
const variations = generateDomainVariations(targetDomain, {
includeVowelSwap: true,
includeGlyphs: true,
includeUnicode: true,
includeDictionary: true,
});
console.log("Potential phishing domains:");
variations.slice(0, 10).forEach((variation) => {
console.log(variation);
});
// Output:
// payp4l.com
// payp4l.com
// p4ypal.com
// paypal.com
// payp4l.com
// ...
```
### 使用特定引擎进行品牌保护
```
import { generateDomainVariations } from "dnstwist-ts";
const brandDomain = "microsoft.com";
const variations = generateDomainVariations(brandDomain, {
includeVowelSwap: true,
includeGlyphs: true,
includeDictionary: true,
includeTldFusion: true,
includeUnicode: false, // Skip Unicode for faster processing
includeBitsquatting: false, // Skip bitsquatting for faster processing
});
console.log(`Generated ${variations.length} potential brand variations`);
// Monitor these variations for potential brand abuse
```
### 使用独立引擎
```
import {
engineVowelswap,
engineGlyphs,
engineUnicode,
engineDictionary,
engineHyphenation,
engineTldFusion,
} from "dnstwist-ts";
const domain = "facebook";
const tld = "com";
// Vowel swapping
const vowelVariations = engineVowelswap(domain);
console.log("Vowel variations:", vowelVariations);
// Output: ['f4cebook', 'f4c3book', 'f4c3b00k', ...]
// Character glyph substitutions
const glyphVariations = engineGlyphs(domain);
console.log("Glyph variations:", glyphVariations.slice(0, 5));
// Output: ['f4cebook', 'f4c3book', 'f4c3b00k', ...]
// Unicode homoglyphs (with punycode conversion)
const unicodeVariations = engineUnicode(domain);
console.log("Unicode variations:", unicodeVariations.slice(0, 5));
// Dictionary-based variations
const dictVariations = engineDictionary(domain, tld);
console.log("Dictionary variations:", dictVariations.slice(0, 5));
// Output: ['wwwfacebook', 'facebookwww', 'www-facebook', ...]
// Hyphenation
const hyphenVariations = engineHyphenation(domain);
console.log("Hyphen variations:", hyphenVariations.slice(0, 5));
// Output: ['f-acebook', 'fa-cebook', 'fac-ebook', ...]
// TLD variations
const tldVariations = engineTldFusion(domain, tld);
console.log("TLD variations:", tldVariations.slice(0, 5));
// Output: ['facebook.net', 'facebook.org', 'facebook.io', ...]
```
### 金融域名保护
```
import { generateDomainVariations } from "dnstwist-ts";
const bankDomain = "chase.com";
const variations = generateDomainVariations(bankDomain, {
includeVowelSwap: true,
includeGlyphs: true,
includeUnicode: true,
includeDictionary: true,
includeHyphenation: true,
includeTldFusion: true,
});
// Focus on variations that could be used for phishing
const phishingCandidates = variations.filter((variation) => {
// Look for variations that are very similar to original
const similarity = calculateSimilarity(bankDomain, variation);
return similarity > 0.8;
});
console.log(`Found ${phishingCandidates.length} high-similarity variations`);
```
### 电商域名监控
```
import { generateDomainVariations } from "dnstwist-ts";
const ecommerceDomain = "amazon.com";
const variations = generateDomainVariations(ecommerceDomain, {
includeVowelSwap: true,
includeGlyphs: true,
includeDictionary: true,
includeTldFusion: true,
});
// Check for variations that might confuse customers
const confusingVariations = variations.filter((variation) => {
// Look for variations that could be easily mistyped
return variation.length <= ecommerceDomain.length + 2;
});
console.log(
"Potentially confusing variations:",
confusingVariations.slice(0, 10)
);
```
### 社交媒体域名保护
```
import { generateDomainVariations } from "dnstwist-ts";
const socialDomain = "twitter.com";
const variations = generateDomainVariations(socialDomain, {
includeVowelSwap: true,
includeGlyphs: true,
includeUnicode: true,
includeDictionary: true,
});
// Look for variations that could be used for fake accounts
const fakeAccountDomains = variations.filter(
(variation) => variation.includes("twitter") && variation !== socialDomain
);
console.log("Potential fake account domains:", fakeAccountDomains.slice(0, 10));
```
### 性能优化
```
import { generateDomainVariations } from "dnstwist-ts";
// For large-scale monitoring, use only essential engines
const fastVariations = generateDomainVariations("example.com", {
includeVowelSwap: true,
includeGlyphs: true,
includeDictionary: false, // Skip dictionary for speed
includeUnicode: false, // Skip Unicode for speed
includeBitsquatting: false, // Skip bitsquatting for speed
includeTldFusion: true, // Keep TLD fusion as it's fast
});
console.log(`Fast generation: ${fastVariations.length} variations`);
```
### 自定义域名分析
```
import {
generateDomainVariations,
engineVowelswap,
engineGlyphs,
removeDuplicates,
} from "dnstwist-ts";
function analyzeDomain(domain: string) {
// Generate variations using different engines
const vowelVariations = engineVowelswap(domain);
const glyphVariations = engineGlyphs(domain);
// Combine and deduplicate
const allVariations = removeDuplicates([
...vowelVariations,
...glyphVariations,
]);
// Analyze the results
const analysis = {
original: domain,
totalVariations: allVariations.length,
vowelVariations: vowelVariations.length,
glyphVariations: glyphVariations.length,
variations: allVariations,
};
return analysis;
}
const result = analyzeDomain("github.com");
console.log(`Analysis for ${result.original}:`);
console.log(`Total variations: ${result.totalVariations}`);
console.log(`Sample variations:`, result.variations.slice(0, 5));
```
### 自定义字典支持
```
import {
generateDomainVariations,
createCustomDictionary,
loadDictionaryFromFile,
loadDictionaryFromUrl,
Dictionary,
} from "dnstwist-ts";
// Create a simple custom dictionary
const simpleDict = createCustomDictionary(["admin", "secure", "login"]);
const variations = generateDomainVariations("example.com", {
includeDictionary: true,
customDictionary: simpleDict,
});
// Create a categorized dictionary
const bankingDict = createCustomDictionary(
["admin", "secure"], // custom words
{
banking: ["bank", "finance", "money", "account"],
security: ["verify", "authenticate", "confirm", "validate"],
}
);
// Use categorized dictionary
const bankingVariations = generateDomainVariations("chase.com", {
includeDictionary: true,
customDictionary: bankingDict,
});
// Load dictionary from file
const fileDict = await loadDictionaryFromFile("./my-dictionary.json");
// Load dictionary from URL
const urlDict = await loadDictionaryFromUrl(
"https://example.com/dictionary.json"
);
```
### 与 DNS 检查集成
```
import { generateDomainVariations } from "dnstwist-ts";
async function checkDomainVariations(domain: string) {
const variations = generateDomainVariations(domain);
const results = [];
for (const variation of variations.slice(0, 10)) {
// Limit for demo
try {
// In a real implementation, you would use a DNS library
// const dns = require('dns');
// const addresses = await dns.promises.resolve4(variation);
// For demo purposes, we'll simulate
const isRegistered = Math.random() > 0.8; // 20% chance of being registered
results.push({
domain: variation,
registered: isRegistered,
// addresses: addresses // In real implementation
});
} catch (error) {
results.push({
domain: variation,
registered: false,
error: error.message,
});
}
}
return results;
}
// Usage
checkDomainVariations("google.com").then((results) => {
const registeredDomains = results.filter((r) => r.registered);
console.log(
`Found ${registeredDomains.length} registered variations:`,
registeredDomains
);
});
```
## 示例目录
本包在 `examples/` 目录中包含了详尽的示例：
- **`basic-usage.js`** - 基本用法示例和简单的域名变体
- **`individual-engines.js`** - 使用各个独立引擎的示例
- **`advanced-usage.js`** - 高级用法模式和自定义分析
- **`dns-integration.js`** - DNS 集成示例（模拟和真实环境）
- **`custom-dictionary.js`** - 自定义字典创建和使用示例
运行示例：
```
cd examples
npm install
npm run basic # Run basic examples
npm run engines # Run individual engine examples
npm run advanced # Run advanced examples
npm run dns # Run DNS integration examples
npm run dictionary # Run custom dictionary examples
npm run all # Run all examples
```
### 开发设置
#### 前置条件
- Node.js 18+
- npm 或 yarn
- Git
#### 项目结构
```
dnstwist-ts/
├── src/ # TypeScript source files
│ ├── index.ts # Main library file
│ └── dictionaryEN.json # English dictionary
├── dist/ # Compiled JavaScript (auto-generated)
├── examples/ # Usage examples
├── package.json # Package configuration
├── tsconfig.json # TypeScript configuration
└── README.md # This file
```
#### 可用脚本
- `npm run build` - 将 TypeScript 编译为 JavaScript
- `npm run dev` - 用于开发的监听模式
- `npm run clean` - 移除 dist 目录
- `npm run prepublishOnly` - 在发布前进行构建
### 获取帮助
- **GitHub Issues**：用于报告 Bug 和提出功能请求
- **GitHub Discussions**：用于提问和一般性讨论
- **Pull Requests**：用于代码贡献
### 行为准则
- 保持尊重和包容
- 专注于建设性的反馈
- 帮助他人学习和成长
- 遵循 [贡献者公约](https://www.contributor-covenant.org/)
### 致谢
贡献者将在以下位置获得致谢：
- README.md 的贡献者部分
- 发布说明
- GitHub 贡献者页面
感谢您对 dnstwist-ts 的贡献！🚀
## 许可证
MIT 许可证 - 详情请参阅 [LICENSE](LICENSE) 文件。
## 鸣谢
本项目是 [@elceef](https://github.com/elceef) 开发的杰出 [dnstwist](https://github.com/elceef/dnstwist) 工具的 TypeScript 移植版。如需查看 Python 原版实现，请访问原始项目。
## 安全提示
本工具专为合法的安全研究、品牌保护和威胁情报目的而设计。请负责任地使用，并遵守相关的法律法规。
标签：MITM代理, TypeScript, 品牌保护, 域名安全, 域名生成, 威胁情报, 安全插件, 开发者工具, 数据可视化, 自动化攻击, 误植域名检测