blechschmidt / massdns

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
GNU General Public License v3.0
3.08k stars 460 forks source link

-t A options resolves with CNAME #92

Closed storenth closed 3 years ago

storenth commented 3 years ago

Now I am using massdns to explicitly get only A records:

massdns -r $resolvers -t A -o S -w ./output.txt ./subdomains.txt

But I got output with CNAMEs too:

# output.txt
0-honeybee.k8s-exp.shopifykloud.com. A 193.58.251.1
_config_.web.mdm.global.druid.shopifykloud.com. CNAME FimglNohlfcjecje._config_.web.mdm.global.druid.shopifykloud.com.
blechschmidt commented 3 years ago

This is desired behavior as massdns just outputs the raw DNS responses. However, CNAME flattening would be a nice optional feature.

I am closing this as it is the same request as in issue #1.

youradds commented 3 years ago

Was there ever a way around this? I'm using:

$massdns_folder/bin/massdns -q -r $massdns_folder/lists/resolvers.txt -o S -t A $massdns_folder/domains-to-do.txt -w $massdns_folder/results.txt

And this correctly gets the A records, but also the CNAME records. What I'm having to do, is add in another step in my Perl script, which finds those CNAME values, and then grabs the A records for the CNAME value:

` if ($type eq "A") {

            if (!$seen->{$domain}) {
                $seen->{$domain} = $ip;
            } else {
                $seen->{$domain} .= " $ip";
            }
        } elsif ($type eq "CNAME") {

            $ip =~ s/\.$//; # get rid of trailing . on CNAME value

            print qq|GOT CNAME: $ip - trying to get IPS for $domain now...\n|;

            my $test = `dig $domain +short | paste -d " " - - -`;
               $test =~ s/\n/ /g;
               $test =~ s/\s+$//g; # get rid of trailing spaces

            if ($test) {

                my @tmp_ips;
                foreach (split / /, $test) {
                    if (/\d+\.\d+\.\d+\.\d+/) {
                        # valid ip...
                        push @tmp_ips, $_;
                    }
                }
                my $ips_grabbed = join (" ", @tmp_ips);
                print qq|\tGOT: $ips_grabbed \n|;
                $seen->{$domain} = $ips_grabbed;
            }

        }`

Its a bit messy and slow, so if there is a better way to do it I'd appreciate a pointer #6

Thanks

Andy