diff --git a/scanner/dnsspider/README.md b/scanner/dnsspider/README.md index bc0ee44..c7e3074 100644 --- a/scanner/dnsspider/README.md +++ b/scanner/dnsspider/README.md @@ -7,32 +7,92 @@ and/or character permutation. ``` $ dnsspider -H + __ _ __ + ____/ /___ ______________ (_)___/ /__ _____ + / __ / __ \/ ___/ ___/ __ \/ / __ / _ \/ ___/ +/ /_/ / / / (__ |__ ) /_/ / / /_/ / __/ / +\__,_/_/ /_/____/____/ .___/_/\__,_/\___/_/ + /_/ ---==[ dnsspider by nullsecurity.net ]==-- + --== [ by nullsecurity.net ] ==-- -usage: - dnsspider.py -t -a [options] +usage -optional arguments: - -t attack type (0 for dictionary 1 for bruteforce) - -a subdomain to bruteforce - -l wordlist, one hostname per line (default: built-in) - -d choose another nameserver (default: your system's) - -i source ip address to use (default: your system's) - -p source port to use (default: 0 -> first free random port) - -u speak via udp or tcp (default: udp) - -c choose charset 0 [a-z0-9], 1 [a-z] or 2 [0-9] (default: 0) - -m max chars to bruteforce (default: 2) - -s prefix for bruteforce, e.g. 'www' - -g postfix for bruteforce, e.g. 'www' - -o timeout (default: 3) - -v verbose mode - prints every attempt (default: quiet) - -w seconds to wait for next request (default: 0) - -x number of threads to use (default: 50) - -f force scanning if wildcard check was positive - -r write found subdomains to file (default: stdout) - -V print version information - -H print this help + dnsspider.py -t -a [opts] | + +target options + + -a - target domain to bruteforce subdomains for + +attack options + + -t - attack type: 0 = dictionary, 1 = bruteforce + -l - wordlist file, one hostname per line (default: built-in) + -c - charset: 0 = [a-z0-9], 1 = [a-z], 2 = [0-9] (default: 0) + -m - max chars for bruteforce (default: 2) + -s - prefix for bruteforce, e.g. 'www' + -g - postfix for bruteforce, e.g. 'www' + -f - force scan when wildcard detected (filters wildcard responses) + -z - attempt zone transfer (AXFR) before scanning + -T - record type(s) to query, comma-separated (default: A) + supported: A, AAAA, CNAME, MX, TXT, NS + +dns options + + -d - nameserver(s), comma-separated for round-robin rotation, + e.g. '8.8.8.8,8.8.4.4,9.9.9.9' (default: system resolver) + -i - source ip address to use (default: system ip) + -p - source port (default: 0 = random free port) + -u - use udp or tcp (default: udp) + -o - timeout in seconds (default: 3) + -w - delay between requests in seconds (default: 0) + -x - number of threads (default: 50) + +output options + + -r - write found subdomains to file (default: stdout) + -F - output format: default, host, json (default: default) + -v - verbose mode, print every attempt + +misc options + + -V - print version information + -H - print this help message + +examples + + # dictionary scan against target.com using built-in wordlist + $ dnsspider.py -t 0 -a target.com + + # dictionary scan with 100 threads and save results to file + $ dnsspider.py -t 0 -a target.com -x 100 -r found.txt + + # bruteforce with alphanumeric charset, 3-char combos, www prefix + $ dnsspider.py -t 1 -a target.com -c 0 -m 3 -s www + + # dictionary scan using google dns, tcp protocol, verbose output + $ dnsspider.py -t 0 -a target.com -d 8.8.8.8 -u tcp -v + + # dictionary scan with custom wordlist and wildcard filtering forced + $ dnsspider.py -t 0 -a target.com -l /path/to/wordlist.txt -f + + # bruteforce digits-only, 2-char combos, google dns, 30 threads + $ dnsspider.py -t 1 -a target.com -c 2 -m 2 -d 8.8.8.8 -x 30 + + # dictionary scan with 500ms delay between requests and 5s timeout + $ dnsspider.py -t 0 -a target.com -w 0.5 -o 5 + + # attempt zone transfer (AXFR) before dictionary scan + $ dnsspider.py -t 0 -a target.com -z + + # query A and AAAA records + $ dnsspider.py -t 0 -a target.com -T A,AAAA + + # output hostnames only for piping into other tools + $ dnsspider.py -t 0 -a target.com -F host | nmap -iL - + + # json output to file + $ dnsspider.py -t 0 -a target.com -F json -r found.json ``` # Author @@ -43,7 +103,7 @@ noptrix - quick'n'dirty code - dnsspider is already packaged and available for [BlackArch Linux](https://www.blackarch.org/) -- My master-branches are always dev-branches; use releases for stable versions. +- My master-branches are always stable; dev-branches are created for current work. - All of my public stuff you find are officially announced and published via [nullsecurity.net](https://www.nullsecurity.net). # License diff --git a/scanner/dnsspider/release/dnsspider-1.4.tar.gz b/scanner/dnsspider/release/dnsspider-1.4.tar.gz deleted file mode 100644 index 9a5aec3..0000000 Binary files a/scanner/dnsspider/release/dnsspider-1.4.tar.gz and /dev/null differ diff --git a/scanner/dnsspider/release/dnsspider-1.5.tar.gz b/scanner/dnsspider/release/dnsspider-1.5.tar.gz new file mode 100644 index 0000000..4974298 Binary files /dev/null and b/scanner/dnsspider/release/dnsspider-1.5.tar.gz differ