search

mandatoryprogrammer / TrustTrees

A Tool for DNS Delegation Trust Graphing
Apache License 2.0
403 stars 70 forks source link

Add an --only-problematic flag and use multiple resolvers #17

Closed oldesec closed 4 years ago

oldesec commented 5 years ago

Hi.

This tool is very interesting.

I am very happy that this store is being maintained.

I have a small opinion.

1.first time

As far as I know, the current option does not have an option that only shows the problem. So, the user have to execute all the results and check them out. This reduces efficiency. For priority, I wish I had the option to view the problematic files.

  1. second time

    It is now seen as using a local resolvers.txt However, it would be good to support multiple resolvers if you check for a large amount of domains. Because many requests can be blacklisted.

What do you think?

Thanks.

KevinHock commented 5 years ago

For 1: I'd agree having an --only-problematic flag in which it only outputted problematic results would be great.

For 2: To clarify, do you mean the use of the hard-coded DNS_WATCH_RESOLVER used when NS results don't have glue records? I'd be happy to add more and make it so that it chooses one at random. (/ Maybe add an --only-dns-watch-resolver flag for those that wanted to preserve the original behavior.)

https://github.com/mandatoryprogrammer/TrustTrees/blob/e1b04aba8c8c119f792c7e63285feb466e181941/trusttrees.py#L659

An additional thing I'd like to add to this public repo, but have been too busy with another project recently to add, are functions that another package can call, that return all problematic results. This makes it so that you can have your e.g. parse domains out of your Terraform repo package call TrustTrees and alert on results :)

Passing AWS credentials to TrustTrees and a bucket/prefix to upload the pngs to an S3 bucket would also be a good feature, in case you made e.g. Jira tickets with the alerts, and wanted to link an S3 signed URL or something, to make the graph easily viewable outside of the box TrustTrees is running on.

oldesec commented 5 years ago

Thank you for your prompt reply.

  1. Yes. We'll be able to identify the problem quickly.

  2. Yes. many DNS scan tools receive a resolvers in the form of a file format. For example, the Massdns tool.

    ./bin/massdns -r lists/resolvers.txt   (-r option)

The function you said would be very good. :)

KevinHock commented 5 years ago

Thanks for making this issue @oldesec!

https://github.com/mandatoryprogrammer/TrustTrees/commit/0fbf2dcaeb7f95896c1993ebe7e19eba8d8f5e49 and https://github.com/mandatoryprogrammer/TrustTrees/commit/bfe5dd1f3f03bff61ca517ee7f776dbbd18c5683 should have added this functionality 🎉

I'll close this issue when I release a new version.

KevinHock commented 4 years ago

I'll close this issue when I release a new version.

Whoops, should have closed this a while back. Thank you so much for making this issue!

We now have only 2 GitHub issues 🎉 🎊