Prunes
Prunes checks a list of subdomains against a list of resolvers. Successful responses are printed to stdout. By providing a non-existent domain name, this can be used to identify resolvers that do NXDOMAIN hijacking.
Usage
By default, Prunes will use a random domain name and only print the resolvers that do not respond to the queries provided. This allows you to use its output to build a list of good resolvers:
$ cat resolvers.txt
1.1.1.1
8.8.8.8
9.9.9.9
50.49.243.135
50.120.215.2
$ cat subdomains.txt
www
mail
remote
blog
webmail
server
ns1
ns2
smtp
secure
$ cat resolvers.txt | ./prunes
1.1.1.1
8.8.8.8
9.9.9.9
If you're more interested in finding out which name servers are hijacking invalid responses, use the -details
flag:
$ cat resolvers.txt | ./prunes -details
50.49.243.135 ::: www.gCVHwgoDl55QLmHw.com => 23.217.138.109
50.49.243.135 ::: www.gCVHwgoDl55QLmHw.com => 23.195.69.108
50.120.215.2 ::: www.gCVHwgoDl55QLmHw.com => 23.217.138.109
50.120.215.2 ::: www.gCVHwgoDl55QLmHw.com => 23.202.231.168
50.49.243.135 ::: webmail.gCVHwgoDl55QLmHw.com => 23.217.138.109
50.49.243.135 ::: webmail.gCVHwgoDl55QLmHw.com => 23.195.69.108
50.120.215.2 ::: webmail.gCVHwgoDl55QLmHw.com => 23.217.138.109
50.120.215.2 ::: webmail.gCVHwgoDl55QLmHw.com => 23.202.231.168
Installation
$ go get -u github.com/leesoh/prunes
Thanks
- BitQuark - dnspop - Great resource for the list of popular subdomains I used while testing.
- @tomnomnom for the help with custom resolvers.