lib/wmap/dns_bruter.rb
# Return a list of valid hosts by brute-forcing the name servers
Return a list of valid hosts by brute-forcing the name servers
Return a list of valid hosts by brute - forcing the name servers
def brute_force_dns (host)
		puts "Start dictionary attacks on the DNS server for: #{host}" if @verbose
		begin
			host=host.strip
			valid_hosts = Array.new
			my_host_tracker = Wmap::HostTracker.instance
			my_host_tracker.data_dir=@data_dir
			dict = Array.new
			if File.exists?(@hosts_dict)
				dict = file_2_list(@hosts_dict)
			elsif File.exists?(@file_hosts)
				dict = my_host_tracker.top_hostname(200)
				my_host_tracker.list_2_file(dict,@hosts_dict)
			else
				abort "Error: Non-existing common hosts dictionary file - #{@host_dict} or hosts file #{@file_hosts}. Please check your file path and name setting again."
			end
			domain=String.new
			unless is_root_domain?(host) or my_host_tracker.sub_domain_known?(host)
				my_hosts=hostname_mutation(host).map {|x| x.split('.')[0]}
				dict+=my_hosts unless my_hosts.empty?
			end
			if is_domain?(host) or my_host_tracker.sub_domain_known?(host)
				domain=host
			elsif
				array_h=host.split('.')
				array_h.shift
				domain=array_h.join('.')
				puts "Domain for #{host}: #{domain}" if @verbose
			end
			dict+=[host.split(".")[0],""]
			puts "Choose Brute-force Dictionary: #{dict}" if @verbose
			cnt=0
			dict.each do |x|
				if @fail_domain_cnt.key?(domain)
					if @fail_domain_cnt[domain]>2
						puts "Error! Multiple ServFail conditions detected in method #{__method__}. Now skip remaining works on: #{sub_domain}" if @verbose
						return valid_hosts
					end
				end
				cnt=cnt+1
				if x.nil?
					next
				elsif x.empty?
					host=domain
				else
					host=[x,".",domain].join.downcase
				end
				valid_hosts.push(host) if valid_dns_record?(host)
				if cnt==10 && valid_hosts.size>=10
					valid_hosts=[host]
					puts "Brute force method fail, as the DNS server response to every host-name threw at it!"
					break
				end
			end
			puts "Found DNS records on domain #{host}: #{valid_hosts}" if @verbose
			@discovered_hosts_from_dns_bruter[host] = valid_hosts
			my_host_tracker = nil
			return valid_hosts.uniq
		rescue Exception => ee
			puts "Exception on method #{__method__}: #{ee}" if @verbose
		end
	end
def brute_force_dns ( host ) puts "Start dictionary attacks on the DNS server for: #{host}" if @verbose begin host = host . strip valid_hosts = Array . new my_host_tracker = Wmap :: HostTracker . instance my_host_tracker . data_dir = @data_dir dict = Array . new if File . exists? ( @hosts_dict ) dict = file_2_list ( @hosts_dict ) elsif File . exists? ( @file_hosts ) dict = my_host_tracker . top_hostname ( 200 ) my_host_tracker . list_2_file ( dict , @hosts_dict ) else abort "Error: Non-existing common hosts dictionary file - #{@host_dict} or hosts file #{@file_hosts}. Please check your file path and name setting again." end domain = String . new unless is_root_domain? ( host ) or my_host_tracker . sub_domain_known? ( host ) my_hosts = hostname_mutation ( host ) . map { | x | x . split ( '.' ) [ 0 ] } dict += my_hosts unless my_hosts . empty? end if is_domain? ( host ) or my_host_tracker . sub_domain_known? ( host ) domain = host elsif array_h = host . split ( '.' ) array_h . shift domain = array_h . join ( '.' ) puts "Domain for #{host}: #{domain}" if @verbose end dict += [ host . split ( "." ) [ 0 ] , "" ] puts "Choose Brute-force Dictionary: #{dict}" if @verbose cnt = 0 dict . each do | x | if @fail_domain_cnt . key? ( domain ) if @fail_domain_cnt [ domain ] > 2 puts "Error! Multiple ServFail conditions detected in method #{__method__}. Now skip remaining works on: #{sub_domain}" if @verbose return valid_hosts end end cnt = cnt + 1 if x . nil? next elsif x . empty? host = domain else host = [ x , "." , domain ] . join . downcase end valid_hosts . push ( host ) if valid_dns_record? ( host ) if cnt == 10 && valid_hosts . size >= 10 valid_hosts = [ host ] puts "Brute force method fail, as the DNS server response to every host-name threw at it!" break end end puts "Found DNS records on domain #{host}: #{valid_hosts}" if @verbose @discovered_hosts_from_dns_bruter [ host ] = valid_hosts my_host_tracker = nil return valid_hosts . uniq rescue Exception => ee puts "Exception on method #{__method__}: #{ee}" if @verbose end end
Return a list of valid hosts by brute-forcing the name servers
Return a list of valid hosts by brute - forcing the name servers
# build the host dictionary for the brute force method # 10/09/2013 add logic to skip brute-forcing the domain in case of experiencing more than 2 Dnsruby::ServFail conditions # Logic to detecting the bluff if the DNS server return hostname we threw to it
host
<not_specific>