securient / dnsenum Goto Github PK

Not a problem, just a feature request: It would be very useful to have AAAA 
support since there might be IPv6-only records that are being missed.

Wild-carded DNS enumeration should be possible and would be a useful feature.  
If its already been determined that the DNS is wildcard, then various queries 
are resolving into the same resource record, i.e.

abc.foo.com == A ==> 10.0.0.1
xyz.foo.com == A ==> 10.0.0.1
fff.foo.com == A ==> 10.0.0.1
.
.
.

Make note of that as:

*.foo.com? == A ==> 10.0.0.1

and anything that doesn't resolve into 10.0.0.1, it isn't a wildcard entry, 
continuing our example:

abc.foo.com == A ==> 10.0.0.1
xyz.foo.com == A ==> 10.0.0.1
fff.foo.com == A ==> 10.0.0.1
db.foo.com == A ==> 192.168.0.123
orf.foo.com == A ==> 10.0.0.1
iwd.foo.com == A ==> 10.0.0.1

.
.
.

Once the enumeration finishes, you could output something like:

*.foo.com? == A ==> 10.0.0.1
db.foo.com == A ==> 192.168.0.123

"DNSenum is a pentesting cool created to enumerate DNS info about domains"

cool? or tool?

./dnsenum.pl --enum -o test.xml example.com

MagicTree fail during import of test.xml file:

20:22.39 Failed reading data file. File /root/log/log.xml is not a supported 
XML format

Platform: Backtrack 5 (daily updated).

(This won't literally work. You need to specify a domain hosted by DnyDNS.)

% perl dnsenum.pl --dnsserver ns1.mydyndns.org example.com
[...]
Trying Zone Transfer for example.com on ns5.mydyndns.org ... 
AXFR record query failed: NOERROR

ns5.mydyndns.org Bind Version: �Dyn
[...]

The "D" in "Dyn" is apparently Unicode and displays as a "unknown character" 
placeholder box in my terminal emulator. Probably something DnyDNS has done 
intentionally (not sure why), and maybe nothing you can do about it, but until 
I cut-and-pasted the string into a web browser, the "?yn" string looked like 
dnsenum was spitting out bad data.

What steps will reproduce the problem?
1. ./dnsenum.pl --dnsserver localhost -v my_domain.com
2. In my /etc/resoslv.conf I have a public DNS Server
3. my_domain.com exists only in my localhost DNS Server.

What is the expected output? What do you see instead?
If --dnsserver option is used, my public DNS server in /etc/resolv.conf
should not be used. I think it is. 

What version of the product are you using? On what operating system?
I am using dnsenum.pl version 1.2 on backtrack beta 4.

Please provide any additional information below.
My Public DNS Server is not used for A, NS and MX resolution, but it is for
AXFR transfert to resolve ns.my_domain.com (probably line 728). So zone
transfert fails because my_domain.com is not know by public DNS server.