Quantcast
Channel: All Posts - Malicious Link - Blog by mubix - Rob Fuller
Viewing all articles
Browse latest Browse all 1156

Hostname bruteforcing on the cheap

$
0
0

Quick update: As @MikeDammpoints out, xargs has a -P option that can do the same thing I’m using parallel for. If you have a supported version of xargs you can use -P 0 to do the same thing as -j0 with parallel, but if your version doesn’t support the 0 you can simply use the same number parallel uses ala:

  • cat subdomains.txt | xargs -P 122 -I subdomain dig +noall subdomain.microsoft.com +answer

This results in roughly the same completion time as it’s parallel counterpart. Thanks @MikeDamm!


There are some great discussions on the NoVA Hackers mailing list. One such discussion was about what the best way to do dns hostname brute forcing was and which tool is better than another. For me, I just use the command line and then parse the results (or just ask the deepmagic.com database ;–)

Here is what I do:

First, you need a good list of DNS sub domains / hostnames. Personally I use the list provided over at http://www.ethicalhack3r.co.uk/zone-transfers-on-the-alexa-top-1-million/ (with a few minor tweaks). If you haven’t read that post and follow-on posts you really should. But take the list and save it locally. Then just run the following command:

  • cat subdomains.txt | xargs -t -I subdomain dig +noall subdomain.microsoft.com +answer

Now, xargs is great but does one thing at a time and can be quite slow if your subdomains list is large. With the use of the amazing tool GNU parallel you can get done in a matter of seconds, well, that or knock over your home router.

  • cat subdomains.txt | parallel -k -j0 dig +noall {}.microsoft.com +answer

Warning: the -j0 option maxes out the possible file handles and jobs that your CPU/kernel can handle, which usually destroys VMs. Just a smaller job count like 100 or 50 if you want the speed without the crash ;–)

with an output something list this:

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146
parallel: Warning: Only enough file handles to run 122 jobs in parallel.Raising ulimit -n or /etc/security/limits.conf may help.parallel: Warning: No more file handles. Raising ulimit -n or /etc/security/limits.conf may help.mail.microsoft.com.   2369    IN  A   131.107.125.5www.microsoft.com.    0   IN  CNAME   toggle.www.ms.akadns.net.toggle.www.ms.akadns.net. 0   IN  CNAME   g.www.ms.akadns.net.g.www.ms.akadns.net.  0   IN  CNAME   lb1.www.ms.akadns.net.lb1.www.ms.akadns.net.    263 IN  A   64.4.11.42m.microsoft.com.  0   IN  CNAME   origin.mobile.ms.akadns.net.origin.mobile.ms.akadns.net. 300 IN   A   65.55.186.235ftp.microsoft.com.    0   IN  CNAME   ftp.microsoft.akadns.net.ftp.microsoft.akadns.net. 259 IN  A   64.4.17.176mobile.microsoft.com. 0   IN  CNAME   origin.mobile.ms.akadns.net.origin.mobile.ms.akadns.net. 300 IN   A   65.55.186.235smtp.microsoft.com.   3600    IN  A   131.107.115.215smtp.microsoft.com.   3600    IN  A   131.107.115.214smtp.microsoft.com.   3600    IN  A   205.248.106.64smtp.microsoft.com.   3600    IN  A   205.248.106.30smtp.microsoft.com.   3600    IN  A   205.248.106.32smtp.microsoft.com.   3600    IN  A   131.107.115.212search.microsoft.com. 0   IN  CNAME   search.microsoft.akadns.net.search.microsoft.akadns.net. 0    IN  CNAME   search.msn.com.edgesuite.net.search.msn.com.edgesuite.net. 0   IN  CNAME   a134.g.akamai.net.a134.g.akamai.net.    19  IN  A   209.107.220.27a134.g.akamai.net.    19  IN  A   209.107.220.35dev.microsoft.com.    0   IN  CNAME   msdn.microsoft.com.msdn.microsoft.com.   0   IN  CNAME   msdn.microsoft.akadns.net.msdn.microsoft.akadns.net. 600    IN  A   157.56.148.19img.microsoft.com.    0   IN  CNAME   i.microsoft.com.edgesuite.net.i.microsoft.com.edgesuite.net. 0 IN   CNAME   a1475.g.akamai.net.a1475.g.akamai.net.   20  IN  A   165.254.158.48a1475.g.akamai.net.   20  IN  A   165.254.158.9news.microsoft.com.   0   IN  CNAME   msnews.microsoft.com.msnews.microsoft.com. 3600    IN  A   207.46.248.16mail2.microsoft.com.  3600    IN  A   131.107.115.215beta.microsoft.com.   0   IN  CNAME   connect.microsoft.akadns.net.connect.microsoft.akadns.net. 300 IN  A   65.52.103.84support.microsoft.com.    0   IN  CNAME   mso-geo.microsoft.akadns.net.mso-geo.microsoft.akadns.net. 0   IN  CNAME   support.microsoft.akadns.net.support.microsoft.akadns.net. 175 IN  A   157.56.56.139my.microsoft.com. 3600    IN  A   134.170.255.29help.microsoft.com.   0   IN  CNAME   help.msn.com.mail3.microsoft.com.  3600    IN  A   131.107.115.214download.microsoft.com.   0   IN  CNAME   download.microsoft.com.nsatc.net.download.microsoft.com.nsatc.net. 0 IN    CNAME   main.dl.ms.akadns.net.main.dl.ms.akadns.net.    0   IN  CNAME   download.microsoft.com.edgesuite.net.download.microsoft.com.edgesuite.net. 0   IN CNAME a954.dscms.akamai.net.a954.dscms.akamai.net.    0   IN  CNAME   a954.dscms.akamai.net.0.1.cn.akamaitech.net.a954.dscms.akamai.net.0.1.cn.akamaitech.net. 1 IN A 69.31.75.184a954.dscms.akamai.net.0.1.cn.akamaitech.net. 1 IN A 69.31.75.168shop.microsoft.com.   3600    IN  A   64.4.11.37shop.microsoft.com.   3600    IN  A   65.55.58.201games.microsoft.com.  3600    IN  A   207.46.166.10business.microsoft.com.   3600    IN  A   65.55.57.98ws.microsoft.com. 0   IN  CNAME   ws.microsoft.com.nsatc.net.gateway.microsoft.com.    3600    IN  A   131.107.16.142gateway.microsoft.com.    3600    IN  A   131.107.16.143members.microsoft.com.    0   IN  CNAME   members.microsoft.akadns.net.members.microsoft.akadns.net. 219 IN  A   65.55.57.28c.microsoft.com.  0   IN  CNAME   c.microsoft.akadns.net.c.microsoft.akadns.net.   215 IN  A   65.55.58.199g.microsoft.com.  0   IN  CNAME   g.msn.com.g.msn.com.        0   IN  CNAME   g.msn.com.nsatc.net.g.msn.com.nsatc.net.  142 IN  A   131.253.34.154mail4.microsoft.com.  3600    IN  A   205.248.106.64mail1.microsoft.com.  3600    IN  A   131.107.115.212apps.microsoft.com.   0   IN  CNAME   apps.windows.akadns.net.apps.windows.akadns.net. 0    IN  CNAME   services.windows.akadns.net.services.windows.akadns.net. 0    IN  CNAME   services-perf.windows.akadns.net.services-perf.windows.akadns.net. 46 IN   A   134.170.30.204email.microsoft.com.  1989    IN  A   157.55.150.73i.microsoft.com.  0   IN  CNAME   i.toggle.www.ms.akadns.net.i.toggle.www.ms.akadns.net. 0 IN  CNAME   i.g.www.ms.akadns.net.i.g.www.ms.akadns.net.    0   IN  CNAME   i.microsoft.com.edgesuite.net.i.microsoft.com.edgesuite.net. 0 IN   CNAME   a1475.g.akamai.net.a1475.g.akamai.net.   8   IN  A   23.62.111.114a1475.g.akamai.net.   8   IN  A   23.62.111.104s.microsoft.com.  0   IN  CNAME   reroute.microsoft.com.reroute.microsoft.com.    3600    IN  A   64.4.11.37reroute.microsoft.com.    3600    IN  A   65.55.58.201community.microsoft.com. 0    IN  CNAME   communities.microsoft.com.communities.microsoft.com. 3600   IN  A   64.4.11.37communities.microsoft.com. 3600   IN  A   65.55.58.201connect.microsoft.com.    0   IN  CNAME   connect.microsoft.akadns.net.connect.microsoft.akadns.net. 152 IN  A   65.52.103.84rss.microsoft.com.    796 IN  A   65.55.58.201rss.microsoft.com.    796 IN  A   64.4.11.37home.microsoft.com.   0   IN  CNAME   redir.blu.cb3.glbdns.microsoft.com.redir.blu.cb3.glbdns.microsoft.com. 116   IN A    65.55.206.229jp.microsoft.com. 3600    IN  A   65.55.58.201jp.microsoft.com. 3600    IN  A   64.4.11.37labs.microsoft.com.   3600    IN  A   64.4.11.37labs.microsoft.com.   3600    IN  A   65.55.58.201exchange.microsoft.com.   2120    IN  A   65.55.31.35marketing.microsoft.com. 3600 IN  A   207.46.242.110mac.microsoft.com.    3600    IN  A   64.4.11.37mac.microsoft.com.    3600    IN  A   65.55.58.201feeds.microsoft.com.  3600    IN  A   65.55.57.98partners.microsoft.com.   0   IN  CNAME   pmc.partners.microsoft.akadns.net.pmc.partners.microsoft.akadns.net. 300 IN A   131.107.119.14feed.microsoft.com.   0   IN  CNAME   feed.trafficmanager.net.feed.trafficmanager.net. 0    IN  CNAME   feedna.cloudapp.net.feedna.cloudapp.net.  10  IN  A   65.52.9.172partner.microsoft.com.    0   IN  CNAME   portal.partners.microsoft.akadns.net.portal.partners.microsoft.akadns.net. 300 IN A    131.107.119.163cs.microsoft.com. 0   IN  CNAME   wedcs.trafficmanager.net.wedcs.trafficmanager.net. 0   IN  CNAME   wedcseus.cloudapp.net.wedcseus.cloudapp.net.    10  IN  A   137.116.48.250forums.microsoft.com. 0   IN  CNAME   forums.microsoft.akadns.net.forums.microsoft.akadns.net. 600 IN   A   65.52.103.99meet.microsoft.com.   3600    IN  A   131.107.1.71e.microsoft.com.  3600    IN  A   191.234.1.50autodiscover.microsoft.com. 2358 IN   A   131.107.125.5im.microsoft.com. 3600    IN  A   131.107.1.75sip.microsoft.com.    2228    IN  A   65.55.30.130me.microsoft.com. 0   IN  CNAME   edm.cloudapp.net.dig: 'm..microsoft.com' is not a legal name (empty label)billing.microsoft.com.    0   IN  CNAME   paymenthubprod.trafficmanager.net.paymenthubprod.trafficmanager.net. 0 IN   CNAME   paymenthubuxprod1.cloudapp.net.paymenthubuxprod1.cloudapp.net.   10 IN   A   168.62.198.20profile.microsoft.com.    0   IN  CNAME   profile.microsoft.akadns.net.profile.microsoft.akadns.net. 335 IN  A   64.4.11.47research.microsoft.com.   806 IN  A   131.107.65.14sharepoint.microsoft.com. 3463    IN  A   64.4.6.100sharepoint.microsoft.com. 3463    IN  A   65.55.39.10appdev.microsoft.com. 0   IN  CNAME   appdev.windows.akadns.net.appdev.windows.akadns.net. 131    IN  A   134.170.30.200newsletters.microsoft.com. 3150   IN  A   207.46.248.35advertising.microsoft.com. 0  IN  CNAME   advertising.microsoft.com.nsatc.net.advertising.microsoft.com.nsatc.net. 245 IN A 65.52.100.46catalog.microsoft.com.    0   IN  CNAME   genuine.microsoft.akadns.net.genuine.microsoft.akadns.net. 300 IN  A   65.55.58.177social.microsoft.com. 0   IN  CNAME   lb.social.ms.akadns.net.lb.social.ms.akadns.net. 54   IN  A   65.52.103.78events.microsoft.com. 1776    IN  A   64.4.11.31events.microsoft.com. 1776    IN  A   65.55.58.192ajax.microsoft.com.   0   IN  CNAME   mscomajax.vo.msecnd.net.mscomajax.vo.msecnd.net. 208  IN  A   65.54.81.164mscomajax.vo.msecnd.net. 208  IN  A   65.54.81.12developer.microsoft.com. 0    IN  CNAME   msdn.microsoft.com.msdn.microsoft.com.   0   IN  CNAME   msdn.microsoft.akadns.net.msdn.microsoft.akadns.net. 600    IN  A   157.56.148.19bbs.microsoft.com.    0   IN  CNAME   transfer.microsoft.com.transfer.microsoft.com.   3600    IN  A   64.4.10.152backoffice.microsoft.com. 3600    IN  A   64.4.11.37backoffice.microsoft.com. 3600    IN  A   65.55.58.201

Viewing all articles
Browse latest Browse all 1156

Trending Articles