infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

More fixes to enum_dns.rb 

* Should use 'and', not & (bitwise AND)
  * Made capitalization sane for Anglophones. See: http://owl.english.purdue.edu/owl/resource/592/1/
unstable
Tod Beardsley 2012-03-26 16:14:04 -05:00
parent dc6f76eb20
commit 14b45f9fb1
1 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
modules/auxiliary/gather/enum_dns.rb
View File

@ -83,7 +83,7 @@ class Metasploit3 < Msf::Auxiliary
rendsub = rand(10000).to_s
query = @res.query("#{rendsub}.#{target}", "A")
if query.answer.length != 0
print_status("This Domain has Wildcards Enabled!!")
print_status("This domain has wildcards enabled!!")
query.answer.each do |rr|
print_status("Wildcard IP for #{rendsub}.#{target} is: #{rr.address.to_s}") if rr.class != Net::DNS::RR::CNAME
end
@ -94,12 +94,12 @@ class Metasploit3 < Msf::Auxiliary
end
#---------------------------------------------------------------------------------
def genrcd(target)
print_status("Retrieving General DNS Records")
print_status("Retrieving general DNS records")
query = @res.search(target)
if (query)
query.answer.each do |rr|
next unless rr.class == Net::DNS::RR::A
print_status("Domain: #{target} IP Address: #{rr.address} Record: A ")
print_status("Domain: #{target} IP address: #{rr.address} Record: A ")
report_note(:host => rr.address.to_s,
:proto => 'udp',
:sname => 'dns',
@ -114,7 +114,7 @@ class Metasploit3 < Msf::Auxiliary
query1 = @res.search(rr.mname)
if (query1)
query1.answer.each do |ip|
print_status("Start of Authority: #{rr.mname} IP Address: #{ip.address} Record: SOA")
print_status("Start of Authority: #{rr.mname} IP address: #{ip.address} Record: SOA")
report_note(:host => ip.address.to_s,
:proto => 'udp',
:sname => 'dns',
@ -132,7 +132,7 @@ class Metasploit3 < Msf::Auxiliary
if (query1)
query1.answer.each do |ip|
next unless ip.class == Net::DNS::RR::A
print_status("Name Server: #{rr.nsdname} IP Address: #{ip.address} Record: NS")
print_status("Name Server: #{rr.nsdname} IP address: #{ip.address} Record: NS")
report_note(:host => ip.address.to_s,
:proto => 'udp',
:sname => 'dns',
@ -207,7 +207,7 @@ class Metasploit3 < Msf::Auxiliary
query1 = @res.search("#{target}.#{tld}")
if (query1)
query1.answer.each do |rr|
print_status("Domain: #{target}.#{tld} Name: #{rr.name} IP Address: #{rr.address} Record: A ") if rr.class == Net::DNS::RR::A
print_status("Domain: #{target}.#{tld} Name: #{rr.name} IP address: #{rr.address} Record: A ") if rr.class == Net::DNS::RR::A
report_note(:host => rr.address.to_s,
:proto => 'udp',
:sname => 'dns',
@ -222,7 +222,7 @@ class Metasploit3 < Msf::Auxiliary
#-------------------------------------------------------------------------------
def dnsbrute(target, wordlist, nssrv)
print_status("Running Brute Force against Domain #{target}")
print_status("Running bruteforce against domain #{target}")
arr = []
i, a = 0, []
::File.open(wordlist, "rb").each_line do |line|
@ -233,7 +233,7 @@ class Metasploit3 < Msf::Auxiliary
if (query1)
query1.answer.each do |rr|
if rr.class == Net::DNS::RR::A
print_status("Host Name: #{line.chomp}.#{target} IP Address: #{rr.address.to_s}")
print_status("Hostname: #{line.chomp}.#{target} IP address: #{rr.address.to_s}")
report_note(:host => rr.address.to_s,
:proto => 'udp',
:sname => 'dns',
@ -249,7 +249,7 @@ class Metasploit3 < Msf::Auxiliary
#-------------------------------------------------------------------------------
def bruteipv6(target, wordlist, nssrv)
print_status("Brute Forcing IPv6 addresses against Domain #{target}")
print_status("Bruteforcing IPv6 addresses against domain #{target}")
arr = []
i, a = 0, []
arr = IO.readlines(wordlist)
@ -261,7 +261,7 @@ class Metasploit3 < Msf::Auxiliary
if (query1)
query1.answer.each do |rr|
if rr.class == Net::DNS::RR::AAAA
print_status("Host Name: #{line.chomp}.#{target} IPv6 Address: #{rr.address.to_s}")
print_status("Hostname: #{line.chomp}.#{target} IPv6 Address: #{rr.address.to_s}")
report_note(:host => rr.address.to_s,
:proto => 'udp',
:sname => 'dns',
@ -280,7 +280,7 @@ class Metasploit3 < Msf::Auxiliary
#-------------------------------------------------------------------------------
def reverselkp(iprange,nssrv)
print_status("Running Reverse Lookup against ip range #{iprange}")
print_status("Running reverse lookup against IP range #{iprange}")
if not nssrv.nil?
@res.nameserver = (nssrv)
end
@ -295,7 +295,7 @@ class Metasploit3 < Msf::Auxiliary
begin
query = @res.query(tip)
query.each_ptr do |addresstp|
print_status("Host Name: #{addresstp} IP Address: #{tip.to_s}")
print_status("Hostname: #{addresstp} IP address: #{tip.to_s}")
report_note(:host => tip,
:proto => 'udp',
:sname => 'dns',
@ -323,7 +323,7 @@ class Metasploit3 < Msf::Auxiliary
#-------------------------------------------------------------------------------
#SRV Record Enumeration
def srvqry(dom,nssrv)
print_status("Enumerating SRV Records for #{dom}")
print_status("Enumerating SRV records for #{dom}")
i, a = 0, []
#Most common SRV Records
srvrcd = [
@ -350,7 +350,7 @@ class Metasploit3 < Msf::Auxiliary
#-------------------------------------------------------------------------------
#For Performing Zone Transfers
def axfr(target, nssrv)
print_status("Performing Zone Transfer against all nameservers in #{target}")
print_status("Performing zone transfer against all nameservers in #{target}")
if not nssrv.nil?
@res.nameserver=(nssrv)
end
@ -358,7 +358,7 @@ class Metasploit3 < Msf::Auxiliary
query = @res.query(target, "NS")
if (query.answer.length != 0)
(query.answer.select { |i| i.class == Net::DNS::RR::NS}).each do |nsrcd|
print_status("Testing Nameserver: #{nsrcd.nsdname}")
print_status("Testing nameserver: #{nsrcd.nsdname}")
nssrvquery = @res.query(nsrcd.nsdname, "A")
begin
nssrvip = nssrvquery.answer[0].address.to_s
@ -368,18 +368,18 @@ class Metasploit3 < Msf::Auxiliary
if zone.answer.length != 0
namesrvips = @res.query(nsrcd.nsdname,"A")
nsip = namesrvips.answer[0]
print_status("Zone Transfer Successful")
print_status("Zone transfer successful")
report_note(:host => nsip.address.to_s,
:proto => 'udp',
:sname => 'dns',
:port => 53 ,
:type => 'dns.enum',
:data => "Zone Transfer Successful")
:data => "Zone transfer successful")
#Prints each record according to its type
zone.answer.each do |rr|
case rr.type
when "A"
print_status("Name: #{rr.name} IP Address: #{rr.address} Record: A ")
print_status("Name: #{rr.name} IP address: #{rr.address} Record: A ")
report_note(:host => rr.address.to_s,
:proto => 'udp',
:sname => 'dns',
@ -453,10 +453,10 @@ class Metasploit3 < Msf::Auxiliary
end
end
else
print_error("Zone Transfer Failed")
print_error("Zone transfer failed")
end
rescue
print_error("Zone Transfer Failed")
print_error("Zone transfer failed")
end
end
@ -482,15 +482,15 @@ class Metasploit3 < Msf::Auxiliary
end
if(datastore['ENUM_BRT'])
if wldcrd & datastore['STOP_WLDCRD']
print_status("Wildcard Record Found!")
if wldcrd and datastore['STOP_WLDCRD']
print_error("Wildcard record found!")
else
dnsbrute(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS'])
end
end
if(datastore['ENUM_IP6'])
if wldcrd & datastore['STOP_WLDCRD']
if wldcrd and datastore['STOP_WLDCRD']
print_status("Wildcard Record Found!")
else
bruteipv6(datastore['DOMAIN'],datastore['WORDLIST'],datastore['NS'])