projectdiscovery · zer0yu · May 27, 2021 · May 28, 2021 · May 28, 2021 · Jun 28, 2021
diff --git a/README.md b/README.md
@@ -114,7 +114,7 @@ go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
 
 Subfinder will work after using the installation instructions however to configure Subfinder to work with certain services, you will need to have setup API keys. The following services do not work without an API key:
 
-[BeVigil](https://bevigil.com/osint-api), [Binaryedge](https://binaryedge.io), [C99](https://api.c99.nl/), [Certspotter](https://sslmate.com/certspotter/api/), [Chinaz](http://my.chinaz.com/ChinazAPI/DataCenter/MyDataApi), [Censys](https://censys.io), [Chaos](https://chaos.projectdiscovery.io), [DnsDB](https://api.dnsdb.info), [Fofa](https://fofa.info/static_pages/api_help), [Github](https://github.com), [Intelx](https://intelx.io), [Passivetotal](http://passivetotal.org), [Robtex](https://www.robtex.com/api/), [SecurityTrails](http://securitytrails.com), [Shodan](https://shodan.io), [Threatbook](https://x.threatbook.cn/en), [Virustotal](https://www.virustotal.com), [WhoisXML API](https://whoisxmlapi.com/), [Zoomeye](https://www.zoomeye.org)
+[BeVigil](https://bevigil.com/osint-api), [Binaryedge](https://binaryedge.io), [C99](https://api.c99.nl/), [Certspotter](https://sslmate.com/certspotter/api/), [Chinaz](http://my.chinaz.com/ChinazAPI/DataCenter/MyDataApi), [Censys](https://censys.io), [Chaos](https://chaos.projectdiscovery.io), [DnsDB](https://api.dnsdb.info), [Fofa](https://fofa.info/static_pages/api_help), [Github](https://github.com), [Intelx](https://intelx.io), [Passivetotal](http://passivetotal.org), [Robtex](https://www.robtex.com/api/), [SecurityTrails](http://securitytrails.com), [Shodan](https://shodan.io), [Threatbook](https://x.threatbook.cn/en), [Virustotal](https://www.virustotal.com), [WhoisXML API](https://whoisxmlapi.com/), [Zoomeye](https://www.zoomeye.org), [Hunter](https://hunter.qianxin.com/)
 
 These values are stored in the `$HOME/.config/subfinder/provider-config.yaml` file which will be created when you run the tool for the first time. The configuration file uses the YAML format. Multiple API keys can be specified for each of these services from which one of them will be used for enumeration.
 

diff --git a/v2/pkg/passive/sources.go b/v2/pkg/passive/sources.go
@@ -2,6 +2,7 @@ package passive
 
 import (
 	"fmt"
+
 	"strings"
 
 	"golang.org/x/exp/maps"
@@ -27,6 +28,7 @@ import (
 	"github.com/projectdiscovery/subfinder/v2/pkg/subscraping/sources/fullhunt"
 	"github.com/projectdiscovery/subfinder/v2/pkg/subscraping/sources/github"
 	"github.com/projectdiscovery/subfinder/v2/pkg/subscraping/sources/hackertarget"
+	"github.com/projectdiscovery/subfinder/v2/pkg/subscraping/sources/hunter"
 	"github.com/projectdiscovery/subfinder/v2/pkg/subscraping/sources/intelx"
 	"github.com/projectdiscovery/subfinder/v2/pkg/subscraping/sources/passivetotal"
 	"github.com/projectdiscovery/subfinder/v2/pkg/subscraping/sources/quake"
@@ -65,6 +67,7 @@ var AllSources = [...]subscraping.Source{
 	&fullhunt.Source{},
 	&github.Source{},
 	&hackertarget.Source{},
+	&hunter.Source{},
 	&intelx.Source{},
 	&passivetotal.Source{},
 	&quake.Source{},

diff --git a/v2/pkg/passive/sources_test.go b/v2/pkg/passive/sources_test.go
@@ -30,6 +30,7 @@ var (
 		"fullhunt",
 		"github",
 		"hackertarget",
+		"hunter",
 		"intelx",
 		"passivetotal",
 		"quake",
@@ -65,6 +66,7 @@ var (
 		"fofa",
 		"fullhunt",
 		"hackertarget",
+		"hunter",
 		"intelx",
 		"passivetotal",
 		"quake",

diff --git a/v2/pkg/subscraping/sources/hunter/hunter.go b/v2/pkg/subscraping/sources/hunter/hunter.go
@@ -0,0 +1,104 @@
+package hunter
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	jsoniter "github.com/json-iterator/go"
+	"github.com/projectdiscovery/subfinder/v2/pkg/subscraping"
+)
+
+type hunterResp struct {
+	Code    int        `json:"code"`
+	Data    hunterData `json:"data"`
+	Message string     `json:"message"`
+}
+
+type infoArr struct {
+	URL      string `json:"url"`
+	IP       string `json:"ip"`
+	Port     int    `json:"port"`
+	Domain   string `json:"domain"`
+	Protocol string `json:"protocol"`
+}
+
+type hunterData struct {
+	InfoArr []infoArr `json:"arr"`
+	Total   int       `json:"total"`
+}
+
+// Source is the passive scraping agent
+type Source struct {
+	apiKeys []string
+}
+
+// Run function returns all subdomains found with the service
+func (s *Source) Run(ctx context.Context, domain string, session *subscraping.Session) <-chan subscraping.Result {
+	results := make(chan subscraping.Result)
+
+	go func() {
+		defer close(results)
+
+		randomApiKey := subscraping.PickRandom(s.apiKeys, s.Name())
+		if randomApiKey == "" {
+			return
+		}
+
+		var pages = 1
+		for currentPage := 1; currentPage <= pages; currentPage++ {
+			// hunter api doc https://hunter.qianxin.com/home/helpCenter?r=5-1-2
+			qbase64 := base64.URLEncoding.EncodeToString([]byte(fmt.Sprintf("domain=\"%s\"", domain)))
+			resp, err := session.SimpleGet(ctx, fmt.Sprintf("https://hunter.qianxin.com/openApi/search?api-key=%s&search=%s&page=1&page_size=100&is_web=3", randomApiKey, qbase64))
+			if err != nil && resp == nil {
+				results <- subscraping.Result{Source: s.Name(), Type: subscraping.Error, Error: err}
+				session.DiscardHTTPResponse(resp)
+				return
+			}
+
+			var response hunterResp
+			err = jsoniter.NewDecoder(resp.Body).Decode(&response)
+			if err != nil {
+				results <- subscraping.Result{Source: s.Name(), Type: subscraping.Error, Error: err}
+				resp.Body.Close()
+				return
+			}
+			resp.Body.Close()
+
+			if response.Code == 401 || response.Code == 400 {
+				results <- subscraping.Result{Source: s.Name(), Type: subscraping.Error, Error: fmt.Errorf("%s", response.Message)}
+				return
+			}
+
+			if response.Data.Total > 0 {
+				for _, hunterInfo := range response.Data.InfoArr {
+					subdomain := hunterInfo.Domain
+					results <- subscraping.Result{Source: s.Name(), Type: subscraping.Subdomain, Value: subdomain}
+				}
+			}
+			pages = int(response.Data.Total/1000) + 1
+		}
+	}()
+
+	return results
+}
+
+// Name returns the name of the source
+func (s *Source) Name() string {
+	return "hunter"
+}
+
+func (s *Source) IsDefault() bool {
+	return true
+}
+
+func (s *Source) HasRecursiveSupport() bool {
+	return false
+}
+
+func (s *Source) NeedsKey() bool {
+	return true
+}
+
+func (s *Source) AddApiKeys(keys []string) {
+	s.apiKeys = keys
+}