blechschmidt / massdns

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
GNU General Public License v3.0
3.13k stars 462 forks source link

Simple list output please :) #112

Closed gprime31 closed 3 years ago

gprime31 commented 3 years ago

Simple list like: example.com example.ca example.in exams.co etc... simple list format for use with httprobe and amass Thanks :)

mzpqnxow commented 3 years ago

I'm not a massdns developer, but I have contributed some scripts to make things easier for use-cases like this

If you output to NDJSON format using -o J , you can use the following JQ program on the file:

https://github.com/blechschmidt/massdns/blob/master/scripts/massdnsA.jq

Unmodified, it will emit lines like this:

example.com 1.2.3.4
example.ca 2.3.4.5
example.in 3.4.5.6

You can very easily modify it to not emit the answer at all, so you just have the FQDN, as you specified

If you really don't want to keep any of the details on disk, then you can skip the NDJSON format and just use grep to select the question, since that seems to be all you want:

massdns -r resolvers.lst -o S -w - input.lst | grep -Po '^[^ ]+(?=\.)'

In my experience (and my use-cases in particular) it's important to do some analysis/post-processing of the detailed output before using the data for anything. At the very least it's important to identify responses resulting from zones that have wildcard records, especially if you're going to consider an FQDN to be an HTTP virtual host. But I guess if you don't need to worry about that, using -o S and grep is the simplest and fastest way to do what you want to do

Hope this is helpful

blechschmidt commented 3 years ago

I agree that such an output mode is probably required in many use-cases, which is why 0ce8f4baf4ada03e2cfb59e50fcedacf45754b4f adds it. In particular, when the reliability of resolvers is high (e.g. when probing authoritative nameservers directly), it may be quite useful.