mdaxfr

- Mass DNS AXFR
git clone git://git.acid.vegas/mdaxfr.git
Log | Files | Refs | Archive | README | LICENSE

mdaxfr.py (7477B)

      1 #!/usr/bin/env python
      2 # Mass DNS AXFR - developed by acidvegas in python (https://git.acid.vegas/mdaxfr)
      3 
      4 import logging
      5 import os
      6 import re
      7 import urllib.request
      8 
      9 try:
     10 	import dns.rdatatype
     11 	import dns.query
     12 	import dns.zone
     13 	import dns.resolver
     14 except ImportError:
     15 	raise SystemExit('missing required \'dnspython\' module (pip install dnspython)')
     16 
     17 
     18 # Colours
     19 BLUE   = '\033[1;34m'
     20 CYAN   = '\033[1;36m'
     21 GREEN  = '\033[1;32m'
     22 GREY   = '\033[1;90m'
     23 PINK   = '\033[1;95m'
     24 PURPLE = '\033[0;35m'
     25 RED    = '\033[1;31m'
     26 YELLOW = '\033[1;33m'
     27 RESET  = '\033[0m'
     28 
     29 
     30 def attempt_axfr(domain: str, nameserver: str, nameserver_ip: str):
     31 	'''
     32 	Request a zone transfer from a nameserver on a domain.
     33 
     34 	:param domain: The domain to perform the zone transfer on.
     35 	:param nameserver: The nameserver to perform the zone transfer on.
     36 	:param nameserver_ip: The IP address of the nameserver.
     37 	'''
     38 
     39 	print(f'                {YELLOW}Attempting AXFR for {CYAN}{domain}{RESET} on {PURPLE}{nameserver} {GREY}({nameserver_ip}){RESET}')
     40 
     41 	zone = dns.zone.from_xfr(dns.query.xfr(nameserver_ip, domain))
     42 
     43 	record_count = sum(len(node.rdatasets) for node in zone.nodes.values())
     44 
     45 	print(f'                {GREEN}AXFR successful for {CYAN}{domain}{RESET} on {PURPLE}{nameserver} {GREY}({nameserver_ip}){RESET} - {record_count:,} records')
     46 
     47 	with open(os.path.join('axfrout', f'{domain}_{nameserver}_{nameserver_ip}.log'), 'w') as file:
     48 		file.write(zone.to_text())
     49 
     50 
     51 def get_nameservers(domain: str) -> list:
     52 	'''
     53 	Generate a list of the root nameservers.
     54 
     55 	:param target: The target domain to get the nameservers for.
     56 	'''
     57 
     58 	ns_records  = dns.resolver.resolve(domain, 'NS', lifetime=30)
     59 	nameservers = [str(rr.target)[:-1] for rr in ns_records]
     60 
     61 	return nameservers
     62 
     63 
     64 def get_root_tlds(output_dir: str) -> list:
     65 	'''
     66 	Get the root TLDs from a root nameservers.
     67 
     68 	:param output_dir: The output directory to use.
     69 	'''
     70 	rndroot = [root for root in os.listdir(output_dir) if root.endswith('.root-servers.net.txt')]
     71 	if rndroot:
     72 		rndroot_file = rndroot[0]  # Take the first file from the list
     73 		tlds = sorted(set([item.split()[0][:-1] for item in open(os.path.join(root_dir, rndroot_file)).read().split('\n') if item and 'IN' in item and 'NS' in item]))
     74 	else:
     75 		logging.warning('Failed to find root nameserver list...fallback to using IANA list')
     76 		tlds = urllib.request.urlopen('https://data.iana.org/TLD/tlds-alpha-by-domain.txt').read().decode('utf-8').lower().split('\n')[1:]
     77 	return tlds
     78 
     79 
     80 def get_psl_tlds() -> list:
     81 	'''Download the Public Suffix List and return its contents.'''
     82 	data = urllib.request.urlopen('https://publicsuffix.org/list/public_suffix_list.dat').read().decode()
     83 	domains = []
     84 	for line in data.split('\n'):
     85 		if line.startswith('//') or not line:
     86 			continue
     87 		if '*' in line or '!' in line:
     88 			continue
     89 		if '.' not in line:
     90 			continue
     91 		domains.append(line)
     92 	return domains
     93 
     94 
     95 def resolve_nameserver(nameserver: str) -> list:
     96 	'''
     97 	Resolve a nameserver to its IP address.
     98 
     99 	:param nameserver: The nameserver to resolve.
    100 	'''
    101 
    102 	data = []
    103 
    104 	for version in ('A', 'AAAA'):
    105 		data.extend([ip.address for ip in dns.resolver.resolve(nameserver, version, lifetime=30)])
    106 
    107 	return data
    108 
    109 
    110 def process_domain(domain: str):
    111 	domain = re.sub(r'^https?://|^(www\.)|(/.*$)', '', domain)
    112 
    113 	print(f'{PINK}Looking up nameservers for {CYAN}{domain}{RESET}')
    114 
    115 	try:
    116 		nameservers = get_nameservers(domain)
    117 	except Exception as ex:
    118 		print(f'    {RED}Error resolving nameservers for {CYAN}{domain} {GREY}({ex}){RESET}')
    119 		return
    120 	
    121 	if not nameservers:
    122 		print(f'    {GREY}No nameservers found for {CYAN}{domain}{RESET}')
    123 		return
    124 	
    125 	print(f'    {BLUE}Found {len(nameservers):,} nameservers for {CYAN}{domain}{RESET}')
    126 
    127 	for nameserver in nameservers:
    128 		print(f'        {PINK}Looking up IP addresses for {PURPLE}{nameserver}{RESET}')
    129 
    130 		try:
    131 			nameserver_ips = resolve_nameserver(nameserver)
    132 		except Exception as ex:
    133 			print(f'            {RED}Error resolving IP addresses for {PURPLE}{nameserver} {GREY}({ex}){RESET}')
    134 			continue
    135 
    136 		if not nameserver_ips:
    137 			print(f'            {GREY}No IP addresses found for {PURPLE}{nameserver}{RESET}')
    138 			continue
    139 
    140 		print(f'            {BLUE}Found {len(nameserver_ips):,} IP addresses for {PURPLE}{nameserver}{RESET}')
    141 
    142 		for nameserver_ip in nameserver_ips:
    143 			attempt_axfr(domain, nameserver, nameserver_ip)
    144 
    145 
    146 
    147 if __name__ == '__main__':
    148 	import argparse
    149 	import concurrent.futures
    150 	import sys
    151 
    152 	parser = argparse.ArgumentParser(description='Mass DNS AXFR')
    153 	parser.add_argument('-d', '--domain', type=str, help='domain to perform AXFR on')
    154 	parser.add_argument('-i', '--input', type=str, help='input file')
    155 	parser.add_argument('-t', '--tlds', action='store_true', help='Perform AXFR on all TLDs')
    156 	parser.add_argument('-p', '--psl', action='store_true', help='use the Public Suffix List')
    157 	parser.add_argument('-c', '--concurrency', type=int, default=30, help='maximum concurrent tasks')
    158 	parser.add_argument('-o', '--output', dest='output_dir', type=str, default='axfrout', help='output directory')
    159 	args = parser.parse_args()
    160 
    161 	logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
    162 
    163 	# Create output directories
    164 	os.makedirs(args.output_dir, exist_ok=True)
    165 	root_dir = os.path.join(args.output_dir, 'root')
    166 	os.makedirs(root_dir, exist_ok=True)
    167 
    168 	# Set DNS timeout
    169 	dns.resolver._DEFAULT_TIMEOUT = 30
    170 
    171 	with concurrent.futures.ThreadPoolExecutor(max_workers=args.concurrency) as executor:
    172 		if args.domain:
    173 			# Single domain mode
    174 			process_domain(args.domain)
    175 		
    176 		elif args.input:
    177 			# Input file mode
    178 			try:
    179 				with open(args.input, 'r') as f:
    180 					domains = [line.strip() for line in f if line.strip()]
    181 				futures = [executor.submit(process_domain, domain) for domain in domains]
    182 				for future in concurrent.futures.as_completed(futures):
    183 					try:
    184 						future.result()
    185 					except Exception as e:
    186 						logging.error(f'Error processing domain: {e}')
    187 			except FileNotFoundError:
    188 				logging.error(f'Input file not found: {args.input}')
    189 				sys.exit(1)
    190 
    191 		elif args.tlds:
    192 			# TLD mode
    193 			logging.info('Fetching root nameservers...')
    194 			# First get root nameservers
    195 			for root in get_nameservers('.'):
    196 				try:
    197 					attempt_axfr('', root, os.path.join(root_dir, f'{root}.txt'))
    198 				except Exception as e:
    199 					logging.error(f'Error processing root nameserver {root}: {e}')
    200 
    201 			# Then process TLDs
    202 			logging.info('Processing TLDs...')
    203 			tlds = get_root_tlds(root_dir)
    204 			futures = []
    205 			for tld in tlds:
    206 				try:
    207 					nameservers = get_nameservers(tld)
    208 					for ns in nameservers:
    209 						futures.append(executor.submit(process_domain, tld))
    210 				except Exception as e:
    211 					logging.error(f'Error processing TLD {tld}: {e}')
    212 			
    213 			for future in concurrent.futures.as_completed(futures):
    214 				try:
    215 					future.result()
    216 				except Exception as e:
    217 					logging.error(f'Error in TLD task: {e}')
    218 
    219 		elif args.psl:
    220 			# PSL mode
    221 			logging.info('Fetching PSL domains...')
    222 			psl_dir = os.path.join(args.output_dir, 'psl')
    223 			os.makedirs(psl_dir, exist_ok=True)
    224 			
    225 			domains = get_psl_tlds()
    226 			futures = []
    227 			for domain in domains:
    228 				try:
    229 					futures.append(executor.submit(process_domain, domain))
    230 				except Exception as e:
    231 					logging.error(f'Error processing PSL domain {domain}: {e}')
    232 			
    233 			for future in concurrent.futures.as_completed(futures):
    234 				try:
    235 					future.result()
    236 				except Exception as e:
    237 					logging.error(f'Error in PSL task: {e}')
    238 
    239 		else:
    240 			parser.print_help()
    241 			sys.exit(1)