search

d3mondev / puredns

Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.
GNU General Public License v3.0
1.72k stars 160 forks source link

Wildcard filtering is not working right with long domains (version 2.1.2) #50

Closed thepoorhacker closed 1 year ago

thepoorhacker commented 1 year ago

Hello, Yesterday, I tried the version 2.1.1 resolve capabilities with a list of names and wildcard filtering didn't work right, I checked puredns repository and found that you have pushed a fix for wildcard filtering with long domain (my list was containing lots of them), so I cloned the repo and build puredns from source and get version 2.1.2 to work, after that I tried the resolve feature of puredns twice, the first time it worked, but the second time it didn't. of course both attempts (two different lists of domains) were done in three different hosts (I double checked the one that gave false positives). I hope my English helped me here to explain it. if there is anything not clear please let me know.

Regards

d3mondev commented 1 year ago

Hi,

Glad you managed to find the fix that I haven't released yet! 😊 Also your English is 👌🏻

You mention that it worked one time, and the other time it didn't. Usually, it's a sign that the public resolvers aren't always returning valid results, and that prevents puredns from filtering wildcards. Results can be inconsistent when that happens - sometimes it works, other times it doesn't. So my advice is to make sure your that you don't have bad resolvers in your list of resolvers.

Another advice is to use the new --trusted-only flag to use only trusted resolvers. It should give you much more consistent results, but it's going to be slow on large list of subdomains.

If you can reproduce a bug 100% of the time with the --trusted-only flag, then there might be a bug in puredns. I would need a list of domains to resolve to reproduce the problem, and if possible your list of trusted resolvers if you're not using the default. Then I can reproduce on my end and see what's going on.

Hope that helps!

thepoorhacker commented 1 year ago

Hello, Actually, I can say safely now that your fix works perfectly, I tried a new set of trusted dns resolvers and everything worked fine (so there is a bad guy in my list and I have to find it). I want to thank you for the awesome work you have done here and the fast response to my comment. Thank you very Much. I am going to close this issue, since it wasn't a bug in puredns.

Regards