f8al / DNSrazzle

A pure python tool for finding and comparing typo-squatting, bytesqatting, and homoglyph domain attacks and brand impersonation
https://f8al.github.io/DNSrazzle/
Apache License 2.0
38 stars 9 forks source link

registered domains are coming back as not resolvable #23

Closed f8al closed 1 year ago

f8al commented 1 year ago

for the sake of clarity this is being run of foo.com

command:python3 -B dnsrazzle.py -d foo.com -o /tmp

one of the permitted domains is "foof.com"

foof.com is registered:

default@default: $>whois foof.com | grep -A 21 "Domain Name: FOOF.COM"
   Domain Name: FOOF.COM
   Registry Domain ID: 849717_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.godaddy.com
   Registrar URL: http://www.godaddy.com
   Updated Date: 2023-01-11T16:17:54Z
   Creation Date: 1998-02-06T05:00:00Z
   Registry Expiry Date: 2025-02-05T05:00:00Z
   Registrar: GoDaddy.com, LLC
   Registrar IANA ID: 146
   Registrar Abuse Contact Email: abuse@godaddy.com
   Registrar Abuse Contact Phone: 480-624-2505
   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
   Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
   Name Server: DEWITT.LALLEY.COM
   Name Server: DNS1.CLARITYCONNECT.COM
   Name Server: DNS2.CLARITYCONNECT.COM
   Name Server: WAV2.CLARITYCONNECT.NET
   DNSSEC: unsigned

when dnsrazzle attempts the screenshot it throws the error from selenium browser :

Chromedriver:

[-] Unable to screenshot foof.com!
[!] unknown error: net::ERR_NAME_NOT_RESOLVED
  (Session info: headless chrome=116.0.5845.179)

geckodriver ( firefox):

[*] fooe.com is different from foo.com with a score of 0.58!
[-] Unable to screenshot foof.com!
[!] Reached error page: about:neterror?e=dnsNotFound&u=http%3A//foof.com/&c=UTF-8&d=We%20can%E2%80%99t%20connect%20to%20the%20server%20at%20foof.com.
image

Recommendation:

check if there is an a record in the domain in the dict used to store the permutations for every other check, in addition to the check for a registered date

f8al commented 1 year ago

resolved in pr22