mdaxfr

- Mass DNS AXFR
git clone git://git.acid.vegas/mdaxfr.git
README.md (3445B)
      1 # Mass DNS AXFR (Zone Transfer)
      2 
      3 ![](./.screens/preview.gif)
      4 
      5 ## Information
      6 MDAXFR allows you to perform a DNS [Zone Transfer](https://en.wikipedia.org/wiki/DNS_zone_transfer) against a target domain by resolving all of the domains nameservers to their respective A/AAAA records and making an AXFR attempt against each of the IP addresses. You can also use this tool against the [Root Nameservers](https://en.wikipedia.org/wiki/Root_name_server) and [Top-level Domains](https://en.wikipedia.org/wiki/Top-level_domain) *(TLD)*, including those in the [Public Suffix List](https://en.wikipedia.org/wiki/Public_Suffix_List) *(PSL)* aswell.
      7 
      8 ## Expectations & Legalities
      9 It is expected to set *realistic* expectations when using this tool. In contemporary network configurations, AXFR requests are typically restricted, reflecting best practices in DNS security. While many nameservers now disallow AXFR requests, there may still be occasional instances where configurations permit them. Always exercise due diligence and ensure ethical use.
     10 
     11 ## Usage:
     12 - AXFR a single domain
     13 ```shell
     14 ./mdaxfr ripe.net
     15 ```
     16 
     17 - AXFR a list of domains
     18 ```shell
     19 cat domain_list.txt | ./mdaxfr
     20 ```
     21 
     22 .. or for parellel lookups you can use [GNU Parallel](https://www.gnu.org/software/parallel/):
     23 
     24 ```shell
     25 parallel -a domain_list.txt -j 10 ./mdaxfr
     26 ```
     27 
     28 - AXFR all domains in an AXFR output file
     29 ```shell
     30 domain="ripe.net" cat axfr-ripe.log | grep -aE "\s+IN\s+NS\s+" | grep -avE "^${domain}\.\s+" | awk '{print $1}' | sort -u | sed 's/\.$//' | ./mdaxfr
     31 ```
     32 
     33 - AXFR on all TLDs
     34 ```shell
     35 curl -s 'https://data.iana.org/TLD/tlds-alpha-by-domain.txt' | tail -n +2 | tr '[:upper:]' '[:lower:] | ./mdaxfr
     36 ```
     37 
     38 - AXFR on all PSL TLDs
     39 ```shell
     40 curl -s https://publicsuffix.org/list/public_suffix_list.dat | grep -vE '^(//|.*[*!])' | grep '\.' | awk '{print $1}' | ./mdaxfr
     41 ```
     42 
     43 ## Statistics, laughs, & further thinking...
     44 I only wrote this to shit on **[this bozo](https://github.com/flotwig/TLDR-2/)** who took a dead project & brought it back to life by making it even worse. Rather than making a pull request to give this bloke more credit in his "tenure" as a developer, I decided to just rewrite it all from scratch so people can fork off of *clean* code instead.
     45 
     46 As of my last scan in 2023, I was only able to AXFR the zones for **8** *(.er, .fj, .gp, .mp, .mw, .ni, .sl, .xn--54b7fta0cc)* out of **1,456** root TLDs, & **114** out of **7,977** TLDs in the [Public suffix list](https://publicsuffix.org/). The [addition scripts](./extras/) in this repository provide an additional **37** zone files.
     47 
     48 For laughs, here is a one-liner mass zone axfr:
     49 ```bash
     50 curl -s https://www.internic.net/domain/root.zone | awk '$4=="A" || $4=="AAAA" {print substr($1, 3) " " $5}' | sed 's/\.$//' | xargs -n2 sh -c 'dig AXFR "$0" "@$1"'
     51 ```
     52 **Note:** Don't actually use this lol...
     53 
     54 It is interesting to have seen this has worked on some "darknet" DNS servers...would maybe look into exploring collecting more zones for alterntive DNS routing. I am also intruiged at how much you can explore [ARPANET](https://en.wikipedia.org/wiki/ARPANET) with AXFRs...more ARPAgheddon coming soon...
     55 
     56 ___
     57 
     58 ###### Mirrors for this repository: [acid.vegas](https://git.acid.vegas/mdaxfr) • [SuperNETs](https://git.supernets.org/acidvegas/mdaxfr) • [GitHub](https://github.com/acidvegas/mdaxfr) • [GitLab](https://gitlab.com/acidvegas/mdaxfr) • [Codeberg](https://codeberg.org/acidvegas/mdaxfr)