Battalion
Battalion copied to clipboard
Handle DNS Wildcard entries
Adapt domain-scan to handle edge cases when a wildcard entry is in use. There are still ways to get around the issue using other tools but it slows down the scan tremendously.
Description: DNSRecon with -t 'brt'
does not handle wildcard entries well, data is not usable in it's current form.
Fix: On detection of Wildcard - display notification that a slower scan will take place and trigger a different DNS scan which can handle wildcards and determine valid entries.
Plan is to do the following:
Procedural:
- Prior to DNS scan send a test request to
longweirduniquestring.target.com
and see if it returns an 'A' record - Check if
enable wildcard
flag is set - (a)If 'No" Stop DNS Brute Force and try to proceed
- (b)If 'Yes' Record IP address resolution from
1
and run standard brute force. - (b)Once completed, remove all resolutions from output file which match the recorded IP from
1
- (b)Return modified list plus the default domain (if not present) at the IP recorded from
1
Required changes:
- Create flag for
enable wildcard
- Write routing to test for wildcard being probable
- Modify output of DNSRecon if
enable wildcard
is set - Prevent DNSRecon from running if
enable wildcard
is not set and wildcard is detected - Note presence of wildcard record in report and the value associated with it.