import discovery.DNS as DNS import discovery.IPy as IPy import os import sys class dns_reverse(): def __init__(self, range, verbose=True): self.range = range self.iplist = '' self.results = [] self.verbose = verbose try: DNS.ParseResolvConf('/etc/resolv.conf') nameserver = DNS.defaults['server'][0] except: print('Error in DNS resolvers') sys.exit() def run(self, host): a = host.split('.') a.reverse() s = '.' b = s.join(a) + '.in-addr.arpa' nameserver = DNS.defaults['server'][0] if self.verbose: ESC = chr(27) sys.stdout.write(ESC + '[2K' + ESC + '[G') sys.stdout.write('\r\t' + host) sys.stdout.flush() try: name = DNS.Base.DnsRequest(b, qtype='ptr').req().answers[0]['data'] return host + ':' + name except: pass def get_ip_list(self, ips): """Generates the list of IPs to reverse""" try: list = IPy.IP(ips) except: print('Error in IP format, check the input and try again. (Eg. 192.168.1.0/24)') sys.exit() name = [] for x in list: name.append(str(x)) return name def list(self): self.iplist = self.get_ip_list(self.range) return self.iplist def process(self): for x in self.iplist: host = self.run(x) if host is not None: self.results.append(host) return self.results class dns_force(): def __init__(self, domain, dnsserver, verbose=False): self.domain = domain self.nameserver = dnsserver self.file = 'wordlists/dns-big.txt' self.subdo = False self.verbose = verbose try: fileDir = os.path.dirname(os.path.realpath('__file__')) res_path = os.path.join(fileDir,'lib/resolvers.txt') with open(res_path) as f: self.resolvers = f.read().splitlines() except Exception: print("Resolvers file can't be open.") try: f = open(self.file, 'r') except: print('Error opening DNS dictionary file.') sys.exit() self.list = f.readlines() def getdns(self, domain): DNS.ParseResolvConf('/etc/resolv.conf') dom = domain if self.subdo is True: dom = domain.split('.') dom.pop(0) rootdom = '.'.join(dom) else: rootdom = dom if self.nameserver == "": try: r = DNS.Request(rootdom, qtype='SOA').req() primary, email, serial, refresh, retry, expire, minimum = r.answers[ 0]['data'] test = DNS.Request( rootdom, qtype='NS', server=primary, aa=1).req() except Exception as e: print(e) try: # Check if variable is defined. test except NameError: print('Error, test is not defined.') sys.exit() if test.header['status'] != 'NOERROR': print('[!] Error') sys.exit() self.nameserver = test.answers[0]['data'] elif self.nameserver == 'local': self.nameserver = nameserver return self.nameserver def run(self, host): if self.nameserver == "": self.nameserver = self.getdns(self.domain) print('\n\033[94m[-] Using DNS server: ' + self.nameserver + '\033[1;33;40m\n') hostname = str(host.split('\n')[0]) + '.' + str(self.domain) if self.verbose: ESC = chr(27) sys.stdout.write(ESC + '[2K' + ESC + '[G') sys.stdout.write('\r' + hostname) sys.stdout.flush() try: test = DNS.Request( hostname, qtype='a', server=self.nameserver).req( ) # TODO FIX test is sometimes not getting answers and leads to an indexing error. hostip = test.answers[0]['data'] return hostname + ':' + hostip except Exception: pass def process(self): results = [] for x in self.list: host = self.run(x) if host is not None: print(' : ' + host.split(':')[1]) results.append(host) return results class dns_tld(): def __init__(self, domain, dnsserver, verbose=False): self.domain = domain self.nameserver = dnsserver self.subdo = False self.verbose = verbose # Updated from http://data.iana.org/TLD/tlds-alpha-by-domain.txt self.tlds = [ 'ac', 'academy', 'ad', 'ae', 'aero', 'af', 'ag', 'ai', 'al', 'am', 'an', 'ao', 'aq', 'ar', 'arpa', 'as', 'asia', 'at', 'au', 'aw', 'ax', 'az', 'ba', 'bb', 'bd', 'be', 'bf', 'bg', 'bh', 'bi', 'bike', 'biz', 'bj', 'bm', 'bn', 'bo', 'br', 'bs', 'bt', 'builders', 'buzz', 'bv', 'bw', 'by', 'bz', 'ca', 'cab', 'camera', 'camp', 'careers', 'cat', 'cc', 'cd', 'center', 'ceo', 'cf', 'cg', 'ch', 'ci', 'ck', 'cl', 'clothing', 'cm', 'cn', 'co', 'codes', 'coffee', 'com', 'company', 'computer', 'construction', 'contractors', 'coop', 'cr', 'cu', 'cv', 'cw', 'cx', 'cy', 'cz', 'de', 'diamonds', 'directory', 'dj', 'dk', 'dm', 'do', 'domains', 'dz', 'ec', 'edu', 'education', 'ee', 'eg', 'email', 'enterprises', 'equipment', 'er', 'es', 'estate', 'et', 'eu', 'farm', 'fi', 'fj', 'fk', 'florist', 'fm', 'fo', 'fr', 'ga', 'gallery', 'gb', 'gd', 'ge', 'gf', 'gg', 'gh', 'gi', 'gl', 'glass', 'gm', 'gn', 'gov', 'gp', 'gq', 'gr', 'graphics', 'gs', 'gt', 'gu', 'guru', 'gw', 'gy', 'hk', 'hm', 'hn', 'holdings', 'holiday', 'house', 'hr', 'ht', 'hu', 'id', 'ie', 'il', 'im', 'immobilien', 'in', 'info', 'institute', 'int', 'international', 'io', 'iq', 'ir', 'is', 'it', 'je', 'jm', 'jo', 'jobs', 'jp', 'kaufen', 'ke', 'kg', 'kh', 'ki', 'kitchen', 'kiwi', 'km', 'kn', 'kp', 'kr', 'kw', 'ky', 'kz', 'la', 'land', 'lb', 'lc', 'li', 'lighting', 'limo', 'lk', 'lr', 'ls', 'lt', 'lu', 'lv', 'ly', 'ma', 'management', 'mc', 'md', 'me', 'menu', 'mg', 'mh', 'mil', 'mk', 'ml', 'mm', 'mn', 'mo', 'mobi', 'mp', 'mq', 'mr', 'ms', 'mt', 'mu', 'museum', 'mv', 'mw', 'mx', 'my', 'mz', 'na', 'name', 'nc', 'ne', 'net', 'nf', 'ng', 'ni', 'ninja', 'nl', 'no', 'np', 'nr', 'nu', 'nz', 'om', 'onl', 'org', 'pa', 'pe', 'pf', 'pg', 'ph', 'photography', 'photos', 'pk', 'pl', 'plumbing', 'pm', 'pn', 'post', 'pr', 'pro', 'ps', 'pt', 'pw', 'py', 'qa', 're', 'recipes', 'repair', 'ro', 'rs', 'ru', 'ruhr', 'rw', 'sa', 'sb', 'sc', 'sd', 'se', 'sexy', 'sg', 'sh', 'shoes', 'si', 'singles', 'sj', 'sk', 'sl', 'sm', 'sn', 'so', 'solar', 'solutions', 'sr', 'st', 'su', 'support', 'sv', 'sx', 'sy', 'systems', 'sz', 'tattoo', 'tc', 'td', 'technology', 'tel', 'tf', 'tg', 'th', 'tips', 'tj', 'tk', 'tl', 'tm', 'tn', 'to', 'today', 'tp', 'tr', 'training', 'travel', 'tt', 'tv', 'tw', 'tz', 'ua', 'ug', 'uk', 'uno', 'us', 'uy', 'uz', 'va', 'vc', 've', 'ventures', 'vg', 'vi', 'viajes', 'vn', 'voyage', 'vu', 'wang', 'wf', 'wien', 'ws', 'xxx', 'ye', 'yt', 'za', 'zm', 'zw'] def getdns(self, domain): dom = domain if self.subdo is True: dom = domain.split('.') dom.pop(0) rootdom = '.'.join(dom) else: rootdom = dom if self.nameserver is False: r = DNS.Request(rootdom, qtype='SOA').req() primary, email, serial, refresh, retry, expire, minimum = r.answers[ 0]['data'] test = DNS.Request(rootdom, qtype='NS', server=primary, aa=1).req() if test.header['status'] != 'NOERROR': print('Error') sys.exit() self.nameserver = test.answers[0]['data'] elif self.nameserver == 'local': self.nameserver = nameserver return self.nameserver def run(self, tld): self.nameserver = self.getdns(self.domain) hostname = self.domain.split('.')[0] + '.' + tld if self.verbose: ESC = chr(27) sys.stdout.write(ESC + '[2K' + ESC + '[G') sys.stdout.write('\r\tSearching for: ' + hostname) sys.stdout.flush() try: test = DNS.Request( hostname, qtype='a', server=self.nameserver).req( ) hostip = test.answers[0]['data'] return hostip + ':' + hostname except Exception: pass def process(self): results = [] for x in self.tlds: host = self.run(x) if host is not None: results.append(host) return results