##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::DNS::Enumeration<\/p>\n
def initialize(info = {})
super(update_info(info,
‘Name’ => ‘DNS Record Scanner and Enumerator’,
‘Description’ => %q(
This module can be used to gather information about a domain from a
given DNS server by performing various DNS queries such as zone
transfers, reverse lookups, SRV record brute forcing, and other techniques.
),
‘Author’ => [
‘Carlos Perez <carlos_perez[at]darkoperator.com>’,
‘Nixawk’
],
‘License’ => MSF_LICENSE,
‘References’ => [
[‘CVE’, ‘1999-0532’],
[‘OSVDB’, ‘492’]]))<\/p>\n
register_options(
[
OptString.new(‘DOMAIN’, [true, ‘The target domain’]),
OptBool.new(‘ENUM_AXFR’, [true, ‘Initiate a zone transfer against each NS record’, true]),
OptBool.new(‘ENUM_BRT’, [true, ‘Brute force subdomains and hostnames via the supplied wordlist’, false]),
OptBool.new(‘ENUM_A’, [true, ‘Enumerate DNS A record’, true]),
OptBool.new(‘ENUM_CNAME’, [true, ‘Enumerate DNS CNAME record’, true]),
OptBool.new(‘ENUM_MX’, [true, ‘Enumerate DNS MX record’, true]),
OptBool.new(‘ENUM_NS’, [true, ‘Enumerate DNS NS record’, true]),
OptBool.new(‘ENUM_SOA’, [true, ‘Enumerate DNS SOA record’, true]),
OptBool.new(‘ENUM_TXT’, [true, ‘Enumerate DNS TXT record’, true]),
OptBool.new(‘ENUM_RVL’, [ true, ‘Reverse lookup a range of IP addresses’, false]),
OptBool.new(‘ENUM_TLD’, [true, ‘Perform a TLD expansion by replacing the TLD with the IANA TLD list’, false]),
OptBool.new(‘ENUM_SRV’, [true, ‘Enumerate the most common SRV records’, true]),
OptBool.new(‘STOP_WLDCRD’, [true, ‘Stops bruteforce enumeration if wildcard resolution is detected’, false]),
OptAddressRange.new(‘IPRANGE’, [false, “The target address range or CIDR identifier”]),
OptInt.new(‘THREADS’, [false, ‘Threads for ENUM_BRT’, 1]),
OptPath.new(‘WORDLIST’, [false, ‘Wordlist of subdomains’, ::File.join(Msf::Config.data_directory, ‘wordlists’, ‘namelist.txt’)])
])<\/p>\n
register_advanced_options(
[
OptInt.new(‘TIMEOUT’, [false, ‘DNS TIMEOUT’, 8]),
OptInt.new(‘RETRY’, [false, ‘Number of times to try to resolve a record if no response is received’, 2]),
OptInt.new(‘RETRY_INTERVAL’, [false, ‘Number of seconds to wait before doing a retry’, 2]),
OptBool.new(‘TCP_DNS’, [false, ‘Run queries over TCP’, false])
])
deregister_options(‘DnsClientUdpTimeout’, ‘DnsClientRetry’, ‘DnsClientRetryInterval’, ‘DnsClientTcpDns’)
end<\/p>\n
def run
datastore[‘DnsClientUdpTimeout’] = datastore[‘TIMEOUT’]datastore[‘DnsClientRetry’] = datastore[‘RETRY’]datastore[‘DnsClientRetryInterval’] = datastore[‘RETRY_INTERVAL’]datastore[‘DnsClientTcpDns’] = datastore[‘TCP_DNS’]\n
begin
setup_resolver
rescue RuntimeError => e
fail_with(Failure::BadConfig, “Resolver setup failed – exception: #{e}”)
end<\/p>\n
domain = datastore[‘DOMAIN’]is_wildcard = dns_wildcard_enabled?(domain)<\/p>\n
# All exceptions should be being handled by the library
# but catching here as well, just in case.
begin
dns_axfr(domain) if datastore[‘ENUM_AXFR’]rescue => e
print_error(“AXFR failed: #{e}”)
end
dns_get_a(domain) if datastore[‘ENUM_A’]dns_get_cname(domain) if datastore[‘ENUM_CNAME’]dns_get_ns(domain) if datastore[‘ENUM_NS’]dns_get_mx(domain) if datastore[‘ENUM_MX’]dns_get_soa(domain) if datastore[‘ENUM_SOA’]dns_get_txt(domain) if datastore[‘ENUM_TXT’]dns_get_tld(domain) if datastore[‘ENUM_TLD’]dns_get_srv(domain) if datastore[‘ENUM_SRV’]threads = datastore[‘THREADS’]dns_reverse(datastore[‘IPRANGE’], threads) if datastore[‘ENUM_RVL’]\n
return unless datastore[‘ENUM_BRT’]if is_wildcard
dns_bruteforce(domain, datastore[‘WORDLIST’], threads) unless datastore[‘STOP_WLDCRD’]else
dns_bruteforce(domain, datastore[‘WORDLIST’], threads)
end
end<\/p>\n
def save_note(target, type, records)
data = { ‘target’ => target, ‘records’ => records }
report_note(host: target, sname: ‘dns’, type: type, data: data, update: :unique_data)
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::DNS::Enumeration def initialize(info = {})super(update_info(info,‘Name’ => ‘DNS Record Scanner and Enumerator’,‘Description’ => %q(This module can be used to gather information about a domain from agiven DNS server by performing various DNS queries such as zonetransfers, reverse lookups, SRV record brute forcing, and …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59293","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59293"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59293\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}