mdaxfr- Mass DNS AXFR |
git clone git://git.acid.vegas/mdaxfr.git |
Log | Files | Refs | Archive | README | LICENSE |
mdaxfr.py (7477B)
1 #!/usr/bin/env python 2 # Mass DNS AXFR - developed by acidvegas in python (https://git.acid.vegas/mdaxfr) 3 4 import logging 5 import os 6 import re 7 import urllib.request 8 9 try: 10 import dns.rdatatype 11 import dns.query 12 import dns.zone 13 import dns.resolver 14 except ImportError: 15 raise SystemExit('missing required \'dnspython\' module (pip install dnspython)') 16 17 18 # Colours 19 BLUE = '\033[1;34m' 20 CYAN = '\033[1;36m' 21 GREEN = '\033[1;32m' 22 GREY = '\033[1;90m' 23 PINK = '\033[1;95m' 24 PURPLE = '\033[0;35m' 25 RED = '\033[1;31m' 26 YELLOW = '\033[1;33m' 27 RESET = '\033[0m' 28 29 30 def attempt_axfr(domain: str, nameserver: str, nameserver_ip: str): 31 ''' 32 Request a zone transfer from a nameserver on a domain. 33 34 :param domain: The domain to perform the zone transfer on. 35 :param nameserver: The nameserver to perform the zone transfer on. 36 :param nameserver_ip: The IP address of the nameserver. 37 ''' 38 39 print(f' {YELLOW}Attempting AXFR for {CYAN}{domain}{RESET} on {PURPLE}{nameserver} {GREY}({nameserver_ip}){RESET}') 40 41 zone = dns.zone.from_xfr(dns.query.xfr(nameserver_ip, domain)) 42 43 record_count = sum(len(node.rdatasets) for node in zone.nodes.values()) 44 45 print(f' {GREEN}AXFR successful for {CYAN}{domain}{RESET} on {PURPLE}{nameserver} {GREY}({nameserver_ip}){RESET} - {record_count:,} records') 46 47 with open(os.path.join('axfrout', f'{domain}_{nameserver}_{nameserver_ip}.log'), 'w') as file: 48 file.write(zone.to_text()) 49 50 51 def get_nameservers(domain: str) -> list: 52 ''' 53 Generate a list of the root nameservers. 54 55 :param target: The target domain to get the nameservers for. 56 ''' 57 58 ns_records = dns.resolver.resolve(domain, 'NS', lifetime=30) 59 nameservers = [str(rr.target)[:-1] for rr in ns_records] 60 61 return nameservers 62 63 64 def get_root_tlds(output_dir: str) -> list: 65 ''' 66 Get the root TLDs from a root nameservers. 67 68 :param output_dir: The output directory to use. 69 ''' 70 rndroot = [root for root in os.listdir(output_dir) if root.endswith('.root-servers.net.txt')] 71 if rndroot: 72 rndroot_file = rndroot[0] # Take the first file from the list 73 tlds = sorted(set([item.split()[0][:-1] for item in open(os.path.join(root_dir, rndroot_file)).read().split('\n') if item and 'IN' in item and 'NS' in item])) 74 else: 75 logging.warning('Failed to find root nameserver list...fallback to using IANA list') 76 tlds = urllib.request.urlopen('https://data.iana.org/TLD/tlds-alpha-by-domain.txt').read().decode('utf-8').lower().split('\n')[1:] 77 return tlds 78 79 80 def get_psl_tlds() -> list: 81 '''Download the Public Suffix List and return its contents.''' 82 data = urllib.request.urlopen('https://publicsuffix.org/list/public_suffix_list.dat').read().decode() 83 domains = [] 84 for line in data.split('\n'): 85 if line.startswith('//') or not line: 86 continue 87 if '*' in line or '!' in line: 88 continue 89 if '.' not in line: 90 continue 91 domains.append(line) 92 return domains 93 94 95 def resolve_nameserver(nameserver: str) -> list: 96 ''' 97 Resolve a nameserver to its IP address. 98 99 :param nameserver: The nameserver to resolve. 100 ''' 101 102 data = [] 103 104 for version in ('A', 'AAAA'): 105 data.extend([ip.address for ip in dns.resolver.resolve(nameserver, version, lifetime=30)]) 106 107 return data 108 109 110 def process_domain(domain: str): 111 domain = re.sub(r'^https?://|^(www\.)|(/.*$)', '', domain) 112 113 print(f'{PINK}Looking up nameservers for {CYAN}{domain}{RESET}') 114 115 try: 116 nameservers = get_nameservers(domain) 117 except Exception as ex: 118 print(f' {RED}Error resolving nameservers for {CYAN}{domain} {GREY}({ex}){RESET}') 119 return 120 121 if not nameservers: 122 print(f' {GREY}No nameservers found for {CYAN}{domain}{RESET}') 123 return 124 125 print(f' {BLUE}Found {len(nameservers):,} nameservers for {CYAN}{domain}{RESET}') 126 127 for nameserver in nameservers: 128 print(f' {PINK}Looking up IP addresses for {PURPLE}{nameserver}{RESET}') 129 130 try: 131 nameserver_ips = resolve_nameserver(nameserver) 132 except Exception as ex: 133 print(f' {RED}Error resolving IP addresses for {PURPLE}{nameserver} {GREY}({ex}){RESET}') 134 continue 135 136 if not nameserver_ips: 137 print(f' {GREY}No IP addresses found for {PURPLE}{nameserver}{RESET}') 138 continue 139 140 print(f' {BLUE}Found {len(nameserver_ips):,} IP addresses for {PURPLE}{nameserver}{RESET}') 141 142 for nameserver_ip in nameserver_ips: 143 attempt_axfr(domain, nameserver, nameserver_ip) 144 145 146 147 if __name__ == '__main__': 148 import argparse 149 import concurrent.futures 150 import sys 151 152 parser = argparse.ArgumentParser(description='Mass DNS AXFR') 153 parser.add_argument('-d', '--domain', type=str, help='domain to perform AXFR on') 154 parser.add_argument('-i', '--input', type=str, help='input file') 155 parser.add_argument('-t', '--tlds', action='store_true', help='Perform AXFR on all TLDs') 156 parser.add_argument('-p', '--psl', action='store_true', help='use the Public Suffix List') 157 parser.add_argument('-c', '--concurrency', type=int, default=30, help='maximum concurrent tasks') 158 parser.add_argument('-o', '--output', dest='output_dir', type=str, default='axfrout', help='output directory') 159 args = parser.parse_args() 160 161 logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s') 162 163 # Create output directories 164 os.makedirs(args.output_dir, exist_ok=True) 165 root_dir = os.path.join(args.output_dir, 'root') 166 os.makedirs(root_dir, exist_ok=True) 167 168 # Set DNS timeout 169 dns.resolver._DEFAULT_TIMEOUT = 30 170 171 with concurrent.futures.ThreadPoolExecutor(max_workers=args.concurrency) as executor: 172 if args.domain: 173 # Single domain mode 174 process_domain(args.domain) 175 176 elif args.input: 177 # Input file mode 178 try: 179 with open(args.input, 'r') as f: 180 domains = [line.strip() for line in f if line.strip()] 181 futures = [executor.submit(process_domain, domain) for domain in domains] 182 for future in concurrent.futures.as_completed(futures): 183 try: 184 future.result() 185 except Exception as e: 186 logging.error(f'Error processing domain: {e}') 187 except FileNotFoundError: 188 logging.error(f'Input file not found: {args.input}') 189 sys.exit(1) 190 191 elif args.tlds: 192 # TLD mode 193 logging.info('Fetching root nameservers...') 194 # First get root nameservers 195 for root in get_nameservers('.'): 196 try: 197 attempt_axfr('', root, os.path.join(root_dir, f'{root}.txt')) 198 except Exception as e: 199 logging.error(f'Error processing root nameserver {root}: {e}') 200 201 # Then process TLDs 202 logging.info('Processing TLDs...') 203 tlds = get_root_tlds(root_dir) 204 futures = [] 205 for tld in tlds: 206 try: 207 nameservers = get_nameservers(tld) 208 for ns in nameservers: 209 futures.append(executor.submit(process_domain, tld)) 210 except Exception as e: 211 logging.error(f'Error processing TLD {tld}: {e}') 212 213 for future in concurrent.futures.as_completed(futures): 214 try: 215 future.result() 216 except Exception as e: 217 logging.error(f'Error in TLD task: {e}') 218 219 elif args.psl: 220 # PSL mode 221 logging.info('Fetching PSL domains...') 222 psl_dir = os.path.join(args.output_dir, 'psl') 223 os.makedirs(psl_dir, exist_ok=True) 224 225 domains = get_psl_tlds() 226 futures = [] 227 for domain in domains: 228 try: 229 futures.append(executor.submit(process_domain, domain)) 230 except Exception as e: 231 logging.error(f'Error processing PSL domain {domain}: {e}') 232 233 for future in concurrent.futures.as_completed(futures): 234 try: 235 future.result() 236 except Exception as e: 237 logging.error(f'Error in PSL task: {e}') 238 239 else: 240 parser.print_help() 241 sys.exit(1)