repository·master·Indexed 18 days ago
https://github.com/nmmapper/dnsdumpsterA Python-based reconnaissance tool for performing DNS dumps to identify subdomains, IP addresses, ASN information, and geographic locations for a target domain. It utilizes multiple engines including Netcraft, Virustotal, ThreatCrowd, and SSL Certificates to gather MX and TXT records, detect Web Application Firewalls (WAF) via wafw00f, and identify web server types.
dnsdumpster is a tool designed for performing DNS reconnaissance on target networks. It gathers various pieces of information useful for network reconnaissance, including:
When performing a dump against a domain, Dnsdumpster collects the following types of reconnaissance data:
cloudflare).Install the required Python dependencies using pip from the provided requirements.txt file.
$ pip3 install -r requirements.txtTo set up Dnsdumpster, clone the repository and install the necessary dependencies using pip3. It is highly recommended to perform these steps within a Python virtual environment to avoid dependency conflicts.
git clone https://github.com/wangoloj/dnsdumpster.git
pip3 install -r requirements.txtRun the dnsdumpster.py script with the -d flag followed by the target domain to perform a DNS dump. The tool uses multiple engines (such as DNSdumpster, Netcraft, Virustotal, ThreatCrowd, and SSL Certificates) to gather information.
python3 dnsdumpster.py -d nmmapper.comThe tool uses wafw00f to identify if a subdomain is protected by a Web Application Firewall. You can implement this detection using the WafW00F class from the wafw00f.main module.
from wafw00f.main import WafW00F
detector = WafW00F(host)
waf = detector.identwaf()
if(waf):
return waf[0]
else:
return ""Web server detection is performed by sending an HTTP request to the host and inspecting the Server header in the response. The implementation uses the requests library and a custom User-Agent.
def get_server_type(host):
"""
:param host: the server we want to get it's server
@return str
"""
try:
ua = get_user_agent()
headers = {
'User-Agent': ua,
'From': 'info@nmmapper.com'
}
res = requests.get(add_protocol(host), headers=headers)
if(res.headers):
return res.headers.get("Server")
else:
return ""
except Exception as e:
return ""The tool outputs reconnaissance data in a JSON format. Key fields include:
host: The target domain.mx: The primary MX record.ns: An array of name server objects containing ip and ns (hostname).server: The detected server/provider.subdomains: An array of objects containing:asn: Object containing asn, asn_cidr, asn_country_code, asn_date, asn_description, and asn_registry.geo: Object containing city, country, ip_address, latitude, longitude, and region.txt: An array of TXT records.waf: The detected Web Application Firewall name.{
"asn": null,
"host": "nmmapper.com",
"mx": "mx1.privateemail.com.",
"ns": [
{
"ip": "173.245.59.170",
"ns": "gordon.ns.cloudflare.com."
}
],
"server": "cloudflare",
"subdomains": [
{
"asn": {
"asn": "13335",
"asn_cidr": "104.24.96.0/20",
"asn_country_code": "US",
"asn_date": "2014-03-28",
"asn_description": "CLOUDFLARENET - Cloudflare, Inc., US",
"asn_registry": "arin"
},
"geo": {
"city": "Ashburn",
"country": "US",
"ip_address": "104.24.103.134",
"latitude": 39.0437192,
"longitude": -77.4874899,
"region": "Virginia"
}
}
],
"txt": [],
"waf": "Cloudflare (Cloudflare Inc.)"
}The tool outputs a JSON array of objects, where each object represents a discovered subdomain. Each object contains the following keys:
domain: The target domain.subdomain: The specific subdomain found.subdomain_ip: The IP address associated with the subdomain.asn: An object containing Autonomous System Number information (asn, asn_cidr, asn_country_code, asn_date, asn_description, asn_registry).geo: An object containing geographic data (city, country, ip_address, latitude, longitude, region).waf (optional): The detected Web Application Firewall name.server (optional): The detected web server type.[
{
"asn": {
"asn": "51167",
"asn_cidr": "173.212.192.0/19",
"asn_country_code": "DE",
"asn_date": "2009-10-26",
"asn_description": "CONTABO, DE",
"asn_registry": "ripencc"
},
"domain": "nmmapper.com",
"geo": {
"city": "Munich (Ramersdorf-Perlach)",
"country": "DE",
"ip_address": "173.212.208.249",
"latitude": null,
"longitude": null,
"region": "Bavaria"
},
"subdomain": "www.nmmapper.com",
"subdomain_ip": "173.212.208.249"
}
]Execute the dnsdumpster.py script using the -d flag to specify the target domain. The tool uses multiple engines (such as Netcraft, Virustotal, ThreatCrowd, and SSL Certificates) to perform the DNS dump.
$ python3 dnsdumpster.py -d nmmapper.com