dns-brute2 wildcard checking

[freb]

If a domain uses a wildcard to match on subdomains, all subdomain checks will succeed and you'll waste time waiting for the results.

I need to add in an explicit check for wildcards before performing the full scan. It is true that with a wild card, there are some subdomains that could have explicit entries that match instead of the the wildcard rule and return a different IP address, but in general, you may not want to check all domain names in the list.

To check if a wildcard is in use, do the following:

1. query for the wildcard entry, such as *.example.com
2. query for one random subdomain: 9786sfhiuoyase81.example.com
3. query for a second random subdomain: 9786sfhiuoyase82.example.com
4. query for a third random subdomain: 9786sfhiuoyase83.example.com

If the subdomain returns with an IP, the wildcard is most likely in use. If all three subdomain queries come back with the same IP as the wildcard, it is definitely use a wildcard.

[freb]

dns-brute is most likely not getting any updates since I switched to https://github.com/OWASP/Amass. The only update I would consider would be to just wrap amass, but I don't think that's even a great idea considering there isn't anything additional that makes sense for integration into nmap.