search

evilsocket / dnssearch

A subdomain enumeration tool.
GNU General Public License v3.0
892 stars 140 forks source link

When doing recon on a domain, TXT records are just as interesting as A Records, IMO #7

Closed edyesed closed 7 years ago

edyesed commented 7 years ago

I am not a gopher, but I did wish that this tool would look up TXT records in addition to A records, so I added that functionality.

I'm not sure if this is ideomatic go, or not.. but here's a PR that adds the functionality in the subject.

My linter was mildly upset with lacking comments, and a little bit of the indentation, and the source was changed to please my linter.

ehsandeep commented 7 years ago

@edyesed CNAME records are also interesting, can you pull request for that as well?

ehsandeep commented 7 years ago

@evilsocket displaying records optionally will be good idea, like for -txt, -a ? for now -a comes with default option.

edyesed commented 7 years ago

@madaratech / @evilsocket . I added A as an option, it defaults to true.

FYI: the behavior of net.LookupHost is to follow CNAMEs, so you end up with output like the following 


$ grep assets output_with_a_*

output_with_a_false:           assets.com.com : CNAME d207bhzu25u4mz.cloudfront.net.
output_with_a_true:           assets.com.com : A [13.32.205.120 13.32.205.21 13.32.205.32 13.32.205.51 13.32.205.22 13.32.205.122 13.32.205.56 13.32.205.157 2600:9000:2145:5e00:1a:779f:fec0:93a1 2600:9000:2145:1e00:1a:779f:fec0:93a1 2600:9000:2145:9000:1a:779f:fec0:93a1 2600:9000:2145:9800:1a:779f:fec0:93a1 2600:9000:2145:de00:1a:779f:fec0:93a1 2600:9000:2145:2200:1a:779f:fec0:93a1 2600:9000:2145:ca00:1a:779f:fec0:93a1 2600:9000:2145:5600:1a:779f:fec0:93a1] : CNAME d207bhzu25u4mz.cloudfront.net.
edyesed commented 7 years ago

also, moving convo over to #8

ehsandeep commented 7 years ago

nice work @edyesed 👍