Skip to content

Commit 5a0587c

Browse files
author
unknown.pentester
committed
version 0.24
git-svn-id: http://dnsmap.googlecode.com/svn/trunk@2 c94f0440-1047-0410-9073-f3f9481b7c33
1 parent 6d694df commit 5a0587c

10 files changed

+1603
-0
lines changed

‎CREDITS.txt

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
Main author:
2+
pagvac (gnucitizen.org)
3+
4+
Patches, bug hunting and general feedback:
5+
Borys Lacki (www.bothunters.pl)
6+
Philipp Winter (7c0.org)
7+
meathive (kinqpinz.info)
8+
David Kierznowski (withdk.com)
9+
GNa (gnanet.net)
10+
srl (security.research.labs@gmail.com)

‎Changelog.txt

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
XX/01/2010: dnsmap 0.24 released at www.gnucitizen.org
2+
* IPv6 support
3+
* Makefile included
4+
* delay option (-d) added. This is useful in cases in which dnsmap is killing your bandwidth
5+
* changes made to make dnsmap compatible with OpenDNS
6+
* disclosure of internal IP addresses (RFC 1918) are reported
7+
* updated built-in wordlist
8+
* domains susceptible to "same site" scripting (http://snipurl.com/etbcv) are reported
9+
* completion time is now displayed to the user
10+
* mechanism to attempt to bruteforce wildcard-enabled domains
11+
* unique filename containing timestamp is now created when no specific output filename is supplied by user
12+
* various minor bugs fixed
13+
14+
22/02/2009: dnsmap 0.22 released at www.gnucitizen.org
15+
* saving the results in human-readable and CSV format for easy processing
16+
* fixed bug that disallowed reading wordlists with DOS CRLF format
17+
* improved built-in subdomains wordlist
18+
* new bash script (dnsmap-bulk.sh) included which allows running dnsmap against a list of domains from a user-supplied file. i.e.: bruteforcing several domains in a bulk fashion
19+
* bypassing of signature-based dnsmap detection by generating a proper pseudo-random subdomain when checking for wildcards
20+
21+
17/08/2006: dnsmap 0.1 (first public version) released at foro.elhacker.net
22+
* bruteforcing based on builtin list and user-supplied wordlist
23+
* obtain all available A records for each bruteforced (sub)domain (rather than only one)

‎Makefile

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
CC=gcc
2+
CFLAGS=-I.
3+
DEPS = dnsmap.h
4+
5+
%.o: %.c $(DEPS)
6+
$(CC) -c -o $@ $< $(CFLAGS)
7+
8+
dnsmap: dnsmap.c dnsmap.h
9+
gcc -o dnsmap dnsmap.c -I.

‎README.txt

+167
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
DNSMAP README FILE
2+
3+
INTRODUCTION
4+
5+
dnsmap was originally released in back in 2006 and was inspired by the
6+
fictional story "The Thief No One Saw" by Paul Craig, which can be found
7+
in the book "Stealing the Network - How to 0wn the Box"
8+
9+
dnsmap is mainly meant to be used by pentesters during the information
10+
gathering/enumeration phase of infrastructure security assessments. During the
11+
enumeration stage, the security consultant would typically discover the target
12+
company's IP netblocks, domain names, phone numbers, etc ...
13+
14+
Subdomain brute-forcing is another technique that should be used in the
15+
enumeration stage, as it's especially useful when other domain enumeration
16+
techniques such as zone transfers don't work (I rarely see zone transfers
17+
being publicly allowed these days by the way).
18+
19+
If you are interested in researching stealth computer intrusion techniques,
20+
I suggest reading this excellent (and fun) chapter which you can find for
21+
*free* on the web:
22+
23+
http://www.google.com/search?q=%22The+Thief+No+One+Saw%22+%22Paul+Craig%22
24+
http://www.syngress.com/book_catalog/249_STL_NTW/sample.pdf
25+
http://www.ethicalhacker.net/content/view/45/2/
26+
27+
I'm happy to say that dnsmap was included in Backtrack 2 and 3 - although the version
28+
included is now quite dated - and has been reviewed by the community:
29+
30+
http://backtrack.offensive-security.com/index.php?title=Tools
31+
http://www.linuxhaxor.net/2007/07/14/backtrack-2-information-gathering-all-dnsmap/
32+
http://www.darknet.org.uk/2009/03/dnsmap-022-released-subdomain-bruteforcing-tool/
33+
http://www.gnucitizen.org/blog/new-version-of-dnsmap-out/
34+
35+
36+
COMPILING
37+
38+
Compiling should be straightforward:
39+
40+
$ make
41+
42+
Or:
43+
44+
$ gcc -Wall dnsmap.c -o dnsmap
45+
46+
47+
INSTALLATION
48+
49+
Example of manual installation:
50+
51+
# cp ./dnsmap /usr/local/bin/dnsmap
52+
53+
If you wish to bruteforce several target domains in a bulk fashion, you can use the
54+
included dnsmap-bulk.sh script. Just copy the script to /usr/local/bin/ so you can
55+
call it from any location. i.e.:
56+
57+
# cp ./dnsmap-bulk.sh /usr/local/bin/
58+
59+
And set execute permissions. e.g.:
60+
61+
# chmod ugo+x /usr/local/bin/dnsmap-bulk.sh
62+
63+
64+
LIMITATIONS
65+
66+
This tool won't work with target domains which use wildcards. When a domain
67+
uses wildcards, all bruteforced subdomains will resolve to the same IP address,
68+
which makes enumerating target servers unfeasible.
69+
70+
dnsmap *does* however inform the user when wildcards have been detected and suggests
71+
choosing a different target domain.
72+
73+
74+
FUN THINGS THAT CAN HAPPEN
75+
76+
1. Finding interesting remote access servers (i.e.: https://extranet.targetdomain.com)
77+
78+
2. Finding badly configured and/or unpatched servers (i.e.: test.targetdomain.com)
79+
80+
3. Finding new domain names which will allow you to map non-obvious/hard-to-find netblocks
81+
of your target organization (registry lookups - aka whois is your friend)
82+
83+
4. Sometimes you find that some bruteforced subdomains resolve to internal IP addresses
84+
(RFC 1918). This is great as sometimes they are real up-to-date "A" records which means that
85+
it *is* possible to enumerate internal servers of a target organization from the Internet
86+
by only using standard DNS resolving (as oppossed to zone transfers for instance).
87+
88+
89+
USAGE
90+
91+
Bruteforcing can be done either with dnsmap's built-in wordlist or a user-supplied wordlist.
92+
Results can be saved in CSV and human-readable format for further processing. dnsmap does NOT
93+
require root privileges to be run, and should NOT be run with such privileges for security reasons.
94+
95+
The usage syntax can be obtained by simply running dnsmap without any parameters:
96+
97+
$ ./dnsmap
98+
99+
dnsmap 0.24 - DNS Network Mapper by pagvac (gnucitizen.org)
100+
101+
usage: dnsmap <target-domain> [options]
102+
options:
103+
-w <wordlist-file>
104+
-r <regular-results-file>
105+
-c <csv-results-file>
106+
-d <delay-milliseconds>
107+
e.g.:
108+
dnsmap target-domain.foo
109+
dnsmap target-domain.foo -w yourwordlist.txt -r /tmp/domainbf_results.txt
110+
dnsmap target-fomain.foo -r /tmp/ -d 3000
111+
dnsmap target-fomain.foo -r ./domainbf_results.txt
112+
113+
Example of subdomain bruteforcing using dnsmap's built-in word-list:
114+
115+
$ ./dnsmap targetdomain.foo
116+
117+
Example of subdomain bruteforcing using a user-supplied wordlist:
118+
119+
$ ./dnsmap targetdomain.foo -w wordlist.txt
120+
121+
Example of subdomain bruteforcing using the built-in wordlist and saving the results to /tmp/ :
122+
123+
$ ./dnsmap targetdomain.foo -r /tmp/
124+
125+
Since no filename was provided in the previous example, but rather only a path, dnsmap would create an unique filename which includes the current timestamp. E.g.: /tmp/dnsmap_targetdomain_foo_2009_12_15_234953.txt
126+
127+
Example of subdomain bruteforcing using the built-in wordlist, saving the results to /tmp/, and waiting a random maximum of 3 milliseconds between each request:
128+
129+
$ ./dnsmap targetdomain.foo -r /tmp/ -d 3
130+
131+
It is recommended to use the -d (delay in milliseconds) option in cases where dnsmap is interfering with your online experience. i.e.: killing your bandwidth
132+
133+
For bruteforcing a list of target domains in a bulk fashion use the bash script provided. e.g.:
134+
135+
$ ./dnsmap-bulk.sh domains.txt /tmp/results/
136+
137+
138+
WORDLISTS
139+
140+
http://packetstormsecurity.org/Crackers/wordlists/dictionaries/
141+
http://www.cotse.com/tools/wordlists1.htm
142+
143+
144+
OTHER SIMILAR TOOLS - choice is freedom!
145+
146+
WS-DNS-BFX
147+
http://ws.hackaholic.org/tools/WS-DNS-BFX.tgz
148+
149+
DNSDigger
150+
http://www.ernw.de/download/dnsdigger.zip
151+
152+
Fierce Domain Scan
153+
http://ha.ckers.org/fierce/
154+
155+
Desperate
156+
http://www.sensepost.com/research_misc.html
157+
158+
DNSenum
159+
http://dnsenum.googlecode.com/files/dnsenum1.2.tar.gz
160+
161+
ReverseRaider
162+
http://complemento.sourceforge.net/
163+
164+
165+
--
166+
pagvac | GNUCITIZEN.org
167+
January 2010

‎TODO.txt

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
* multi-threading - use pthread.h?
2+
* allow using a customized list of DNS server to share network load
3+
* allow using DNS server supplied on the command line
4+
* clever subdomain brute-force to discover domains with wildcards enabled
5+
test domains: elhacker.net
6+
* for openDNS users: document how to permanently change DNS server settings so they are not overwritten by DHCP settings
7+
* convert hostent structs to addrinfo ?
8+
* replace inet_ntoa(*((struct in_addr *)host->h_addr_list[j])) with ipstr
9+
* obtain aliases for each domain (CNAME records)
10+
* clever numerical domain bruteforce for clusters. i.e.: www2, www3
11+
* pickup new subdomains via reverse lookups (PTR records)
12+
* better input validation
13+
* improve function that validates target domain
14+
* replace insecure string functions
15+
* fix core dump on long strings within user-provided wordlists

‎dnsmap-bulk.sh

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash
2+
if [[ $# -ne 1 && $# -ne 2 ]]
3+
then
4+
echo "usage: `basename $0` <domains-file> [results-path]";
5+
echo "e.g.:";
6+
echo "`basename $0` domains.txt";
7+
echo "`basename $0` domains.txt /tmp/";
8+
exit
9+
fi
10+
for i in `cat $1`
11+
do
12+
if [[ $# -eq 1 ]]
13+
then
14+
dnsmap $i
15+
elif [[ $# -eq 2 ]]
16+
then
17+
dnsmap $i -r $2
18+
fi
19+
done

0 commit comments

Comments
 (0)