Quantcast
Viewing all articles
Browse latest Browse all 1156

Iterative DNS Brute Forcing

Everyone has their list of hostnames they brute force domains with. In my last post I even mentioned a few ways to use one with XARGS or PARALLEL. But one fact about wordlist brute forcing is that there is no “one list to rule them all”. But over the years of doing DNS record collection I have noticed one thing, most domains have a large number of short hostnames that are easy to remember, usually 4 characters or less.

I’m sure you already know where I’m going with this, I wanted to brute force all possible hostnames up to 4 characters. For a long time I struggled with coding this, but couldn’t wrap my head around it. I would come back to it every so often, finally a few days ago I happened upon a script on gist: https://gist.github.com/petehamilton/4755855 that suited my needs perfectly.

I modified it to suite my needs (just use the yield method) and here is what I ended up with (remember DNS is case insensitive):

Notice: This script doesn’t end, it will keep doing lookups on longer and longer hostnames until you hit CTRL-C

1234567891011121314151617181920212223242526272829303132333435363738394041
#!/usr/bin/env ruby### Brute code stolen form: https://gist.github.com/petehamilton/4755855#@domain = 'microsoft.com'def result?(sub)  results = %x(dig +noall #{sub}.#{@domain} +answer)  if results != ""      puts "============================"      puts "FOUND: \t#{sub}"      puts "============================"      puts "#{results}"      puts "============================"  end  1 == 2enddef crack_yielding(chars)  crack_yield(chars){ |p|      return p if result?(p)  }enddef crack_yield(chars)  chars.each { |c| yield c }  crack_yield(chars) { |c|      chars.each do |x|          yield c + x      end  }endchars = ('a'..'z').to_a(0..9).each {|x| chars << x.to_s} crack_yielding(chars)

This worked but it was slow, so I sped it up using methods that I talked about in my last post and a quick modification:

I used this:

1234567891011121314151617181920212223242526272829303132
#!/usr/bin/env ruby### Brute code stolen form: https://gist.github.com/petehamilton/4755855#def result?(sub)  puts sub      1 == 2enddef crack_yielding(chars)  crack_yield(chars){ |p|      return p if result?(p)  }enddef crack_yield(chars)  chars.each { |c| yield c }  crack_yield(chars) { |c|      chars.each do |x|          yield c + x      end  }endchars = ('a'..'z').to_a(0..9).each {|x| chars << x.to_s} crack_yielding(chars)

which just prints all the possibilities:

1234567
abcdef...

and piped it into parallel + dig:

1
ruby brutelist.rb | parallel -j100 dig +noall {}.microsoft.com +answer

and got the following:

123456789101112131415161718192021
c.microsoft.com. 2   IN  CNAME   c.microsoft.akadns.net.c.microsoft.akadns.net.   499 IN  A   65.55.58.184e.microsoft.com.  3599    IN  A   191.234.1.50g.microsoft.com.  2798    IN  CNAME   g.msn.com.g.msn.com.        99  IN  CNAME   g.msn.com.nsatc.net.g.msn.com.nsatc.net.  148 IN  A   131.253.34.154i.microsoft.com.  779 IN  CNAME   i.toggle.www.ms.akadns.net.i.toggle.www.ms.akadns.net. 44    IN  CNAME   i.g.www.ms.akadns.net.i.g.www.ms.akadns.net.    225 IN  CNAME   i.microsoft.com.edgesuite.net.i.microsoft.com.edgesuite.net. 116 IN CNAME   a1475.g.akamai.net.a1475.g.akamai.net.   16  IN  A   23.45.65.26a1475.g.akamai.net.   16  IN  A   23.45.65.33m.microsoft.com.  3599    IN  CNAME   origin.mobile.ms.akadns.net.origin.mobile.ms.akadns.net. 299 IN   A   65.55.186.235s.microsoft.com.  3599    IN  CNAME   reroute.microsoft.com.reroute.microsoft.com.    3599    IN  A   65.55.58.201reroute.microsoft.com.    3599    IN  A   64.4.11.37cs.microsoft.com. 81  IN  CNAME   wedcs.trafficmanager.net.wedcs.trafficmanager.net. 7   IN  CNAME   wedcseus.cloudapp.net.wedcseus.cloudapp.net.    8   IN  A   137.116.48.250...

Happy bruting. Both scripts can be found on my gists page:

Image may be NSFW.
Clik here to view.

Viewing all articles
Browse latest Browse all 1156

Trending Articles