search

blacklanternsecurity / bbot

A recursive internet scanner for hackers.
https://www.blacklanternsecurity.com/bbot/
GNU General Public License v3.0
4.2k stars 381 forks source link

Custom DNS Resolver List #1041

Closed lappsec closed 6 months ago

lappsec commented 6 months ago

Description It would be great to be able to provide a custom DNS resolver list for subdomain enumeration, especially when performing massdns scans. From what I can tell right now (I may be wrong) it uses the system resolvers, which could be a real bottleneck and comes with the possibility of being blocked for too many requests.

In the past I think bbot used a large list of verified DNS resolvers, but that no longer appears to be the case. I apologize if this is already implemented and I just missed it.

TheTechromancer commented 6 months ago

Massdns uses this resolver list:

https://github.com/blacklanternsecurity/public-dns-servers

lappsec commented 6 months ago

Ok, well that makes more sense - thanks for clearing that up. Is it only the other tools that use the system resolvers?

On one host where I ran bbot I got a warning at the beginning that my system only had one resolver. Then on another system I was getting errors that DNS resolution was failing. I figured it was due to overloading the system resolver(s), but that may not be the case.

TheTechromancer commented 6 months ago

Yes, everything else in BBOT uses the system resolvers. This does result in a lot of DNS queries. Each hostname needs to be resolved to every record type (MX, NS, A, AAAA, etc.), and also checked for wildcards.

We've considered allowing custom resolvers, but so far we've held off on it because it would be hard to enforce across all the modules and tools, and would introduce inconsistency between them. Right now the best solution is just to set whatever DNS servers you want in your OS.