{"action":"created","issue":{"url":"https://api.github.com/repos/OWASP/Amass/issues/24","repository_url":"https://api.github.com/repos/OWASP/Amass","labels_url":"https://api.github.com/repos/OWASP/Amass/issues/24/labels{/name}","comments_url":"https://api.github.com/repos/OWASP/Amass/issues/24/comments","events_url":"https://api.github.com/repos/OWASP/Amass/issues/24/events","html_url":"https://github.com/OWASP/Amass/issues/24","id":356034320,"node_id":"MDU6SXNzdWUzNTYwMzQzMjA=","number":24,"title":"DNS sweeping backwards?","user":{"login":"sea-erkin","id":12565233,"node_id":"MDQ6VXNlcjEyNTY1MjMz","avatar_url":"https://avatars3.githubusercontent.com/u/12565233?v=4","gravatar_id":"","url":"https://api.github.com/users/sea-erkin","html_url":"https://github.com/sea-erkin","followers_url":"https://api.github.com/users/sea-erkin/followers","following_url":"https://api.github.com/users/sea-erkin/following{/other_user}","gists_url":"https://api.github.com/users/sea-erkin/gists{/gist_id}","starred_url":"https://api.github.com/users/sea-erkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sea-erkin/subscriptions","organizations_url":"https://api.github.com/users/sea-erkin/orgs","repos_url":"https://api.github.com/users/sea-erkin/repos","events_url":"https://api.github.com/users/sea-erkin/events{/privacy}","received_events_url":"https://api.github.com/users/sea-erkin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-31T15:50:03Z","updated_at":"2018-08-31T16:02:55Z","closed_at":null,"author_association":"NONE","body":"This may be a non issue or a misunderstanding on my end. When running amass for my personal domain, erkin.xyz, I see the following coming through in the DNS sweeping. My IP address is 204.48.17.202 and when printing the DNS service requests going through, I see a sweep being performed as follows:\r\n\r\nMy ip\r\n204.48.17.202\r\n\r\n4 sample print lines from line 119 in brute.go\r\n127.17.48.204.in-addr.arpa\r\n142.17.48.204.in-addr.arpa\r\n128.17.48.204.in-addr.arpa\r\n143.17.48.204.in-addr.arpa\r\n\r\nIt looks like we are sweeping the octets backwards? Is this intended or am I missing something? Wouldn't we want to sweep the /24 of our original cidr? I.e. 204.48.17.202/24\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/OWASP/Amass/issues/comments/417711027","html_url":"https://github.com/OWASP/Amass/issues/24#issuecomment-417711027","issue_url":"https://api.github.com/repos/OWASP/Amass/issues/24","id":417711027,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNzcxMTAyNw==","user":{"login":"caffix","id":7319658,"node_id":"MDQ6VXNlcjczMTk2NTg=","avatar_url":"https://avatars3.githubusercontent.com/u/7319658?v=4","gravatar_id":"","url":"https://api.github.com/users/caffix","html_url":"https://github.com/caffix","followers_url":"https://api.github.com/users/caffix/followers","following_url":"https://api.github.com/users/caffix/following{/other_user}","gists_url":"https://api.github.com/users/caffix/gists{/gist_id}","starred_url":"https://api.github.com/users/caffix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caffix/subscriptions","organizations_url":"https://api.github.com/users/caffix/orgs","repos_url":"https://api.github.com/users/caffix/repos","events_url":"https://api.github.com/users/caffix/events{/privacy}","received_events_url":"https://api.github.com/users/caffix/received_events","type":"User","site_admin":false},"created_at":"2018-08-31T16:02:55Z","updated_at":"2018-08-31T16:02:55Z","author_association":"MEMBER","body":"Many factors can influence the order of the requests, and more than one sweep can be taking place at once. Also, the sweep takes place on IP addresses with lower and higher host numbers than the IP originally discovered.\r\n\r\nIf you would like to develop a new algorithm for the reverse DNS sweeping, I would welcome and appreciate your contribution to the project!"}}
{"actor":{"display_login":"caffix"}}